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Document Purpose 


and Overview 



Upon request by the United States Senate Select Committee on Intelligence (SSCI), New 
Knowledge reviewed an expansive data set of social media posts and metadata provided to 
SSCI by Facebook, Twitter, and Alphabet, plus a set of related data from additional platforms. 
The data sets were provided by the three primary platforms to serve as evidence for an 
investigation into the Internet Research Agency (IRA) influence operations. 

The organic post content in this data set has never previously been seen by the public. Our 
report quantifies and contextualizes Internet Research Agency (IRA) influence operations 
targeting American citizens from 2014 through 2017, and articulates the significance 
of this long-running and broad influence operation. It includes an overview of Russian 
influence operations, a collection of summary statistics, and a set of key takeaways that 
are then discussed in detail later in the document. The document includes links to full data 
visualizations, hosted online, that permit the reader to explore facets of the IRA-created 
manipulation ecosystem. 

Finally, we share our concluding notes and recommendations. We also provide a 
comprehensive slide deck accommodating a wide array of selected images directly from the 
data set illustrating our observations, and, as an appendix, a comprehensive summary of 
relevant statistics related to the data set. 

This publication and its conclusions are in part based on the analysis of social media content that the authors were provided by 
the Senate Select Committee on Intelligence under the auspices of the Committee's Technical Advisory Group, whose members 
serve to provide substantive technical and expert advice on topics of importance to ongoing Committee activity and oversight. The 
findings, interpretations, and conclusions presented herein are those of the authors, and do not necessarily represent the views of 
the Senate Select Committee on Intelligence or its Membership. 
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Russian Interference 



Data Set Provenance and Analysis Parameters 

Broadly, Russian interference in the U.S. Presidential Election of 2016 took three distinct forms, 
one of which is within the scope of our analysis: 

1. Attempts to hack online voting systems (as detailed by a United States Senate Select 
Committee on Intelligence report) 

2. A cyber-attack targeting the Democratic National Committee, executed by the GRU, 
which led to a controlled leak via Wikileaks of email data related to the Clinton 
Presidential campaign team 

3. A sweeping and sustained social influence operation consisting of various coordinated 
disinformation tactics aimed directly at US citizens, designed to exert political influence 
and exacerbate social divisions in US culture 

This last form of interference, a multi-year coordinated disinformation effort conducted by the 
Russian state-supported Internet Research Agency (IRA), is the topic of this analysis. 

The United States Senate Select Committee on Intelligence (SSCI) began an investigation 
into the IRA's social media activities following the 2016 election around the same time that 
investigative journalists and third-party researchers became aware that IRA's campaign had 
touched all major platforms in the social network ecosystem. In March 2018, some of the 
social platform companies misused by the IRA (Twitter, Facebook, and Alphabet) provided 
the SSCI with data related to IRA influence operations. Facebook's data submission includes 
Facebook Page posts and Instagram account content. Alphabet's data submission includes 
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RUSSIAN INTERFERENCE BACKGROUND AND CONTEXT 


Google AdWords and YouTube video and channel data. The data set reveals that Alphabet's 
subsidiaries YouTube, G+, Gmail, and Google Voice were each leveraged to support the 
creation and validation of false personas. 

Evidence provided by these companies to SSCI ties the IRA operation to widespread activity 
on other popular social platforms including Vine, Gab, Meetup, VKontakte, and LiveJournal. 
Several complete websites were created to host original written content, and to provide source 
material for related social accounts and personas. The breadth of the attack included games, 
browser extensions, and music apps created by the IRA and pushed to targeted groups, 
including US teenagers. The popular game Pokemon Go was incorporated into the operation, 
illustrating the fluid, evolving, and innovative tactical approach the IRA leveraged to interfere in 
US politics and culture. 

Several platforms that confirmed the presence of IRA interference operations (Reddit, Tumbir, 
Pinterest, and Medium) were not part of the formal SSCI investigation or data requests, 
and that content was not included in the SSCI data set. They have cooperated with law 
enforcement, and their information has been incorporated into a parallel Department of Justice 
investigation; the Mueller indictment of Russian nationals, Netyksho et al, dated 07/13/18, 
specifically references Tumbir-based interference operations. In the interest of thorough 
analysis. New Knowledge took initiative to also analyze relevant data from Reddit, Tumbir, and 
Pinterest in addition to the data set provided by SSCI. 

The data set provided to the SSCI for the purposes of this analysis includes extensive amounts 
of data previously unknown to the public; it is the first comprehensive analysis by entities other 
than the social platforms themselves. 

None of the platforms (Twitter, Facebook, and Alphabet) appears to have turned over complete 
sets of related data to SSCI. Some of what was turned over was in PDF form; other data sets 
contained extensive duplicates. Each lacked core components that would have provided a 
fuller and more actionable picture. For example: 

• The platforms didn't include methodology for identifying the accounts; we are assuming 
the provenance and attribution is sound for the purposes of this analysis. 

• They didn't include anonymized user comments, eliminating a key path to gauge impact. 

• They didn't include any conversion pathway data to elucidate how individuals came to 
follow the accounts, eliminating another key path to gauge impact. 

• There was minimal metadata. 
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RUSSIAN INTERFERENCE BACKGROUND AND CONTEXT 


• One data set did not include any user engagement data at all. 

Regrettably, it appears that the platforms may have misrepresented or evaded in some of their 
statements to Congress; one platform claimed that no specific groups were targeted (this 
is only true if speaking strictly of ads), while another dissembled about whether or not the 
Internet Research Agency created content to discourage voting (it did). It is unclear whether 
these answers were the result of faulty or lacking analysis, or a more deliberate evasion. 

IRA Background 

The IRA began its operations in mid-2013 in St. Petersburg, Russia. Run like a sophisticated 
marketing agency in a centralized office environment, the IRA employed and trained over a 
thousand people to engage in round-the-clock influence operations, first targeting Ukrainian 
and Russian citizens, and then, well before the 2016 US election, Americans. The scale of 
their operation was unprecedented —they reached 126 million people on Facebook, at least 
20 million users on Instagram, 1.4 million users on Twitter, and uploaded over 1,000 videos to 
YouTube. As Department of Justice indictments have recently revealed, this manipulation of 
American political discourse had a budget that exceeded $25 million USD and continued well 
into 2018. IRA documents indicate the 2017 operational budget alone was $12.2 million US 
dollars. Independent researchers and social platforms were aware of the IRA as early as 2015, 
and its activities on Facebook are well-documented and discussed in detail in Adrian Chen's 
"The Agency". Subsequent glimpses into the operational structure and strategy of the IRA can 
be found in the February 2018 indictment of 13 Russian nationals by Special Counsel Robert 
Mueller, and the September 28, 2018 criminal complaint of United States of America v. Elena 
Alekseevna Khusyaynova. 

The September 2018 indictment reveals that "[t]he Conspiracy has sought to conduct what 
it called internally 'information warfare against the United States of America.'" (p.6 of DOJ 
Khusyaynova Complaint). The data provided to SSCI clearly illustrates that for approximately 
five years, Russia has waged a propaganda war against American citizens, manipulating social 
media narratives to influence American culture and politics. 

We hope that this analysis of the IRA information warfare arsenal - particularly the discussion 
of the influence operation tactics - helps policymakers and American citizens alike to 
understand the sophistication of the adversary, and to be aware of the ongoing threat to 
American democracy. 
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Key Takeaways 



Statistical Highlights 

• The comprehensive dataset included: 

■ ~10.4 million tweets (of which ~6 million were original) across 3841 twitter accounts 

■ -1100 YouTube videos across 17 account channels 

■ -116,000 Instagram posts across 133 accounts 

■ -61,500 unigue Facebook posts across 81 Pages 

• There were -77 million engagements on Facebook, -187 million engagements on 
Instagram, and -73 million engagements on original content on Twitter. Precise summary 
statistics are presented later in this report. 

Key Observations 

• The Threat Persists 

■ Active and ongoing interference operations remain on several platforms. 

• Unpublicized Prominence of Instagram Operations 

■ Instagram was a significant front in the IRA's influence operation, something that 
Facebook executives appear to have avoided mentioning in Congressional testimony. 

■ There were 187 million engagements on Instagram. Facebook estimated that this was 
across 20 million affected users. There were 76.5 million engagements on Facebook; 
Facebook estimated that the Facebook operation reached 126 million people. It is 
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KEY TAKEAWAYS 


possible that the 20 million is not accounting for impact from regrams, which may be 
difficult to track because Instagram does not have a native sharing feature. 

■ In 2017, as media covered their Facebook and Twitter operations, the IRA shifted much 
of its activity to Instagram. 

■ Instagram engagement outperformed Facebook, which may indicate its strength as a 
tool in image-centric memetic (meme) warfare. Alternately, it is possible that the IRA's 
Instagram engagement was the result of click farms; a few of the provided accounts 
reference what appears to be a live engagement farm. 

■ Our assessment is that Instagram is likely to be a key battleground on an ongoing basis. 

• Extensive Operations Targeting Black-American Communities 

■ The most prolific IRA efforts on Facebook and Instagram specifically targeted Black 
American communities and appear to have been focused on developing Black 
audiences and recruiting Black Americans as assets. 

■ The IRA created an expansive cross-platform media mirage targeting the Black 
community, which shared and cross-promoted authentic Black media to create an 
immersive influence ecosystem. 

■ The IRA exploited the trust of their Page audiences to develop human assets, at least 
some of whom were not aware of the role they played. This tactic was substantially 
more pronounced on Black-targeted accounts. 

■ The degree of integration into authentic Black community media was not replicated in 
the otherwise Right-leaning or otherwise Left-leaning content. 

• Voter Suppression Operations 

■ Despite statements from Twitter and Facebook debating whether it was possible 
to gauge whether voter suppression content was present, there were three primary 
variants of specific voter suppression narratives spread on Twitter, Facebook, 
Instagram, and YouTube. 

♦ Malicious misdirection (Twitter-based text-to-vote scams, tweets designed to create 
confusion about voting rules) 

♦ Candidate support redirection (Vote for a 3''^ party!') 

♦ Turnout depression ('stay home on Election Day, your vote doesn't matter') 
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• Sowing Literal Division: Secession 

■ The IRA sowed both secessionist and insurrectionist sentiments, attempting to 
exacerbate discord against the government at federal, state, and local levels. 

■ Content focused on secessionist movements including Texas secession (#texit) and 
California (#calexit). These were compared to #Brexit. 

• Pro-Trump Operations Commence During Primaries 

■ The IRA had a very clear bias for then-candidate Trump's that spanned from early in the 
campaign and throughout the data set. 

■ A substantial portion of political content articulated pro-Donald Trump sentiments, 
beginning with the early primaries. 

■ Aside from an extremely small set of early posts supporting Rand Paul, this preference 
was consistent throughout the Right-leaning IRA-created communities. 

■ Some of the pages targeting traditionally Left-leaning audiences, such as United 
Muslims, very occasionally broached the idea that their members might consider 
Trump as well. 

• Comprehensive Anti-Hillary Clinton Operations 

■ A substantial portion of political content articulated anti-Hillary Clinton sentiments 
among both Right and Left-leaning IRA-created communities. 

■ There was no pro-Clinton content on Facebook or Instagram, aside from a single 
United Muslims Facebook Event promoting a rally encouraging Muslims to publicly 
demonstrate in support of Clinton's candidacy. However, the bulk of the content on that 
same page was anti-Clinton, and the anti-Clinton motive behind this ostensibly pro- 
Clinton post is transparent. 

■ There were some pro-Clinton Twitter posts (tweets and retweets), however, the 
developed Left-wing Twitter personas were still largely anti-Clinton and expressed pro- 
Bernie Sanders and pro-Jill Stein sentiments. 

■ These tactics and goals overlapped with the pro-Trump portion of the operation. 

• Operations Targeting Prominent Figures 

■ IRA operations targeted a wide range of Republican leaders, including Sens. Ted Cruz, 
Marco Rubio, Lindsay Graham, John McCain, and Dr. Ben Carson. 

■ There were significant IRA mentions that aimed to increase or erode support for 
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KEY TAKEAWAYS 


prominent political figures, including Julian Assange, Robert Mueller, and James 
Comey. These mentions were largely an attempt to shape audience perception during a 
relevant news cycle. 

■ Given the recent news regarding a pending indictment of Mr. Assange, it is perhaps 
notable that there were a number of posts expressing support for Assange and 
Wikileaks, including several on October 4th, 2016, the day before Roger Stone's text 
message history indicated Mr. Stone believed hacked email data would be made public 
via Wikileaks. 

■ These tactics and goals overlapped with the pro-Trump portion of the operation. 
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Based on publicly available open-source research, Twitter's release of 10 million IRA tweets, 
and the United States House of Representatives' release of the Facebook ad data, there is a 
prevailing narrative that the Internet Research Agency was focused on dividing Americans, 
and that the operation's focus on elections was merely a small subset of that activity. While 
accurate, this narrative misses nuance and deserves more contextualization in light of the 
additional material contained in the Google and YouTube data set, and the collection of the 
hundreds of thousands of non-ad "organic" memes and posts provided to SSCI. 

The IRA had a roster of themes, primarily social issues, that they repeatedly emphasized and 
reinforced across their Facebook, Instagram, and YouTube content. 


Black culture, community. Black Lives Matter 
Blue Lives Matter, pro-police 
Anti-refugee, pro-immigration reform 
Texas culture, community, and pride 
Southern culture (Confederate history) 
Separatist movements and secession 
Muslim culture, community, and pride 
Christian culture, community, and pride 
LGBT culture, community, and pride 
Native American culture, community, 
and pride 


Meme and "red pill" culture 
Patriotism and Tea Party culture 
Liberal and feminist culture 
Veteran's Issues 
Gun rights, pro-2nd Amendment 
Political Pro-Trump, anti-Clinton content 
Pro-Bernie Sanders and Jill Stein 
content 

Syria and ISIS, pro-Assad, anti-U.S. 

involvement 

Trust in media 
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THEMES 


These recurring topics were grouped thematically on Facebook Pages and Instagram accounts 
designed to reinforce community and culture and to foster feelings of pride. The material can 
be classified into three broad groups: Black-targeted, politically Left-targeted, and politically 
Right-targeted. While other distinct ethnic and religious groups were the focus of one or two 
Facebook Pages or Instagram accounts, the Black community was targeted extensively with 
dozens; this is why we have elected to assess the messaging directed at Black Americans as a 
distinct and significant operation for purposes of this report. 

The themes selected by the IRA were deployed to create and reinforce tribalism within each 
targeted community; in a majority of the posts created on a given Page or account, the IRA 
simply reinforced in-group camaraderie. They punctuated cultural-affinity content with political 
posts, and content demonizing out-groups. Partisan content was presented to targeted groups 
in on-brand ways, such as a meme featuring Jesus in a Trump campaign hat on an account 
that targeted Christians. A few traditionally hot-button issues, such as abortion, did not get 
their own dedicated thematic accounts but appeared sporadically across a few hundred posts 
on pages that generally focused on other things. 



Two themes were disseminated nearly identically across all targeted communities: narratives 
to erode trust in mainstream media, and narratives to convey Russian's state-sanctioned 
talking points on the Syrian conflict. 

On Twitter, where communities are amorphous, the IRA personas discussed the themes listed 
above but also included many others. The activity was driven by local and current events; the 
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THEMES 


themes appeared, but the accounts additionally worked in popular culture references, including 
emerging conspiracy theories. 

While media narratives around the Russian/IRA Twitter activity have often focused on 
automation and bots, the agency ran human-operated precision personas that roughly 
mapped to the same Black, Left, and Right clusters observed on Facebook and Instagram. The 
personas were spontaneous and responsive, engaging with real users (famous influencers 
and media as well as regular people), participating in real-time conversations, creating polls, 
and playing hashtag games. These personas developed relationships with American citizens. 
They were designed to influence individuals and to shape narratives; the IRA appears to have 
attempted to solidify the positioning of well-developed Twitter accounts as influencers by 
alluding to them by name or screenshot in their posts on other platforms (i.e., TEN_GOP's 
Twitter content shared on the Facebook account Stand for Freedom). The Twitter personas 
regularly retweeted content by prominent and influential public figures; they were occasionally 
retweeted by influencers in return. The automated accounts were primarily news-focused, and 
largely limited to tweeting headlines and retweeting other accounts. 

In addition to memetic content and tweets, the IRA pushed narratives with longform blog 
content. They created media properties, websites designed to produce stories that would 
resonate with those targeted. It appears, based on the data set provided by Alphabet, that the 
IRA may have also expanded into think tank-style communiques. One such page, previously 
unattributed to the IRA but included in the Alphabet data, was Gl Analytics, a geopolitics blog 
with an international masthead that included American authors. This page was promoted 
via AdWords and YouTube videos; it has strong ties to more traditional Russian propaganda 
networks, which will be discussed later in this analysis. Gl Analytics wrote articles articulating 
nuanced academic positions on a variety of sophisticated topics. From the site's About page: 

"Our purpose and mission are to provide high-quality analysis at a time when we 
are faced with a multitude of crises, a collapsing global economy, imperialist wars, 
environmental disasters, corporate greed, terrorism, deceit, GMO food, a migration 
crisis and a crackdown on small farmers and ranchers." 

And, finally, in service to these themes, the IRA co-opted the names of real groups with existing 
reputations serving the targeted communities - including United Muslims of America, Cop 
Block, Black Guns Matter, and L for Life. This was perhaps an attempt to loosely backstop an 
identity if a curious individual did a Google Search, or to piggyback on an established brand. 
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Summary Statistics: 
A Cross-Platform Operation 



Internet Research Agency-attributed domains 


blackvswhite.info 

dntshoot.com 

donotshoot.us 

blackmattersusa.com 

blackmattersus.com 

blacktivist.info 

blacktolive.org 

blacksoul.us 


proudtobeblack.org 

black4black.info 

patriotsus.com 

butthis.com 

dudeers.com 

imsanbernardino.info 

biackfist.pro 

reportsecret.com 


*USAReally.com, another IRA-attributed site, launched during the SSCI investigation 


Dates of First Posts 

The dates of first posts (see graphs on next page) suggest that the iRA was active on Twitter 
for severai years prior to their efforts commencing on Facebook and instagram; however, given 
that the Senate Seiect Committee on inteiiigence requested data from January 1,2015 on, it 
is possibie that some iRA content that appeared on Facebook or instagram was simpiy not 
inciuded in the data provided. 

interestingiy, it appears that a majority of the instagram accounts were created reiativeiy eariy 
in the operation, then increasingiy ieveraged as the operation continued (instagram activity 
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SUMMARY STATISTICS: A CROSS-PLATFORM OPERATION 


increased overtime, including in 2017). Facebook Pages appear to have been created or 
leveraged later, with a wave of Pages that began to post leading into Election 2016. 
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Full summary statistics with charts and graphs highlighting platform activity, domains shared, 
ad spend, and more can be found in the accompanying slide deck analysis of the IRA data set. 
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Organic Activities 



Organic Activity: YouTube 

The IRA appears to have begun making YouTube videos in Sept 2015, producing 1107 
videos across 17 channels. A few channels were active until July 2017. Several aggregated 
or repurposed Vine content. Two channels were specifically political, focused on the 2016 
election. Three channels (30 videos) were devoted to Syria & related Near East conflicts. One 
was affiliated with Gl Analytics, which also ran AdWords, and the others were both variants of 
the name "New Inform" (related to a site of the same name). 

By far the most content was related to 
Black Lives Matter & police brutality: 1063 
videos split across 10 different channels 
(59% of the channels, 96% of the content). 
571 had title keywords related to the 
police and focused on police abuses. In 
light of this, YouTube's statement before 
the first Senate tech hearing - "These 
channels' videos were not targeted to the 
U.S. or to any particular sector of the U.S. 
population" - is perhaps using 'target' in 

■ Syria ■ Black community ■ Misc Political Blmmigration BGuns the paid SenSe, bUt appears disingenUOUS. 
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INTERNET RESEARCH AGENCY YOUTUBE CHANNEL LIST 


A Word of Truth (Williams & Kalvin) 
Backyard of the White House 

Black Matters 
BlackToLive 
Cop Block US 
Don't Shoot 

Global Independent Analytics 


New Inform 
Newinform Newinform 
Paul Jefferson 
PoliceState 
Starling Brown 
STOP A. I. 

Stop Police Brutality 


• GUNS4LIFE 

• Plong Zi 

*Backyard of the White House content is still aggregated and accessible online at the link 

Across all channels, 25 videos had election-related keywords in the title (candidate names, 
"vote"/"voting", "election", etc). These videos were all anti-Plillary Clinton. One of the political 
channels, Paul Jefferson, solicited videos for a #PeeOnHillary video challenge (the hashtag 
appeared on Twitter and Instagram) and shared submissions that it received. Videos on the 
'A Word of Truth" channel - the YouTube channel of Williams & Kalvin Facebook page and @ 
williams.and.kalvin_ Instagram account - included voter suppression tactics targeting African- 
American voters - advocating Black voters stay home, or vote for Jill Stein. Titles included 
"The truth about elections", "HILLARY RECEIVED $20,000 DONATION FROM KKK TOWARDS 
HER OAMPAIGN", "A Word Of Truth: Dr. Alveda against fu**in' Hillary". 

YouTube provided some account metadata to SSCI. Several of the email addresses attached 
to the YouTube accounts were affiliated with Google Plus pages; the remainder were Gmail 
accounts. Several email addresses confirmed links between accounts, and across platforms. 
Addresses williamsjohnsonhiphop(Q)gmail.com and copblockl (Q)gmail.com were both affiliated 
with the "A Word of Truth" channel; copblockl (Q)gmail was also attached to the "Cop Block US" 
YouTube channel. One of the email addresses linked to the "Don't Shoot" YouTube account 
appears to also have been linked to a Tumbir post that advocated that players of Pokemon Go 
name their Pokemon with a police brutality victim's name. 

The two "New Inform" channels had Russian-language sites associated with them, and 
content related to Syria, Turkey, and the Middle East. They appear to be related to the site 
newinform.com. 
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ORGANIC ACTIVITIES 


Organic Activity: Twitter 

An extensive amount of writing has been dedicated to the various facets of the IRA's Twitter 
operation as researcher-acquired data sets, such as the one released by Clemson University and 
FiveThirtyEight, have emerged since Election 2016. In October 2018, Twitter itself released a data set 
of IRA tweets to the public. In light of this, we did a brief analysis of the Twitter data provided to SSCI 
during this investigation. 

The IRA developed a collection of over 3841 persona accounts on Twitter; approximately 1.4 
million people engaged with their tweets. They generated 72,801,807 engagements on their 
original content (not including retweets that they amplified, but which were written by others). 
The tweets from the 3841 persona accounts were delivered to SSCI in two batches; it appears 
that a couple of real accounts were misidentified as Russian, while other IRA were missed and 
discovered later. 

Our investigation into the Twitter accounts corroborates the findings of other researchers and 
media over the past 18 months, and suggests that the English-language activity appears to 
have taken four primary forms: 

• Repurposed accounts from a commercial botnet 

• Newsbots: accounts that tweeted news articles focused on the regions they were 
purportedly from (including Russian-language newsbots targeting Russians); this is 
discussed later in this document in the Media Manipulation section 

• "Right-leaning" accounts that participated in conversations or created political content 
designed to be resonant with right-of-center individuals on the American political spectrum 

• "Left-leaning" accounts that did the same thing for Left-leaning audiences. 

Our perception of the account personas has been confirmed by outside researchers from 
Clemson University and Five Thirty Eight, which released a collection of IRA tweets (a subset of 
the ones provided to the committee) during the period of this investigation. That coding can be 
found in an easily-searchable interface here: by that classification, there were 1280 Russian 
language accounts, 630 Right-leaning, 233 Left-leaning, 54 Newsfeed. As noted elsewhere, 
automation played a role: many of the accounts tweeted at the same time. We visualized users 
clustered by similarity in temporal behavior on page 19. 

In the course of a similarity analysis we discovered still-active bets that were likely part of a 
commercially aeguired or repurposed botnet. 
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ORGANIC ACTIVITIES 


These charts look at Twitter account posting patterns over time. Each row is an individual 
Twitter account, green indicates tweets. Concentrated blocks of color in this plot represent 
users who posted at exactly the same time, and may indicate the use of automation. More 
extended color blocks indicate more intense coordination over a longer period of time. 
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ORGANIC ACTIVITIES 


Based on the metadata provided by Twitter, most of the IRA twitter accounts were registered 
through various proxy services in the United states and Europe. Accounts intended to pass as 
American were registered from U.S. IP addresses, and accounts intended to pass as Germans 
were registered from German IP addresses. A significant number of IRA twitter accounts 
however, were registered from either a single IP address in Venezuela or the IRA building's real 
IP address in St. Petersburg. 

Our impression of the IRA's Twitter operation is that it was largely opportunistic real-time 
chatter; a collection of accounts, for example, regularly played hashtag games. There was a 
substantial amount of retweeting. By contrast, Facebook and Instagram were used to develop 
deeper relationships, to create a collection of substantive cultural media pages dedicated to 
continual reinforcement of in-group and out-group ideals for targeted audiences. Twitter was, 
however, a part of the cross-platform brand building tactic; several of the Facebook, Instagram, 
Tumbir, and Reddit pages had associated Twitter accounts. 

One interesting facet of the Twitter operation was the IRA site "Report Secret" - dozens of the 
IRA Right-wing persona accounts used ReportSecret.com as their bio URL. This site did not 
appear in the content for Facebook or Instagram. Looking at the Twitter bio URLs also revealed 
personas who linked themselves to Gab.ai, to LiveJournal, and to VKontakte. Some of the 
accounts in the bios are still active, although dormant. 

One additional observation of note is an observation of absence: the data provided by Twitter 
did not include accounts, thought by many observers to be Russian, that were discovered to 
have engaged in narrative manipulation in 2017. One example of this is (Q)umpire43, which 
engaged in spreading disinformation during the Roy Moore campaign; this account does not 
appear in the SSCI data set. It is still possible that such accounts were Russia-owned, but 
operated by a non-IRA entity. Alternately, they may have belonged to a different adversary. 
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ORGANIC ACTIVITIES 


Organic Activity: Facebook 

The IRA leveraged the majority of Facebook's features, including Ads, Pages, Events, 
Messenger, and even Stickers. Over the past two years, Facebook has undergone a significant 
transformation in how it discusses influence operations on the platform, and it deserves 
commendation for that evolution in thinking. Flowever, the earliest public comments by the 
platform attempted to diminish the IRA operation as just 'a few hundred thousand dollars of 
ads'. This inaccurate assessment has stuck among people who remain skeptical of the IRA 
operation's significance; we hope that this report on the reach of the hundreds of thousands of 
organic posts puts that to rest. 

The Facebook data provided included posts from 81 unique Pages, of which 33 had over 1000 
followers. Of these 33, fourteen major pages focused on Black audiences, five were aimed 
at Left-leaning audiences, one was a travel-focused older page, and thirteen targeted Right¬ 
leaning audiences. Overall, 30 targeted Black audiences and amassed 1,187,810 followers; 

25 targeted the Right and amassed 1,446,588 followers, and 7 targeted the Left and amassed 
689,045 followers. The remaining 19 were a sporadic collection of pages with almost no posts 
and approximately 2000 followers across them. 

As mentioned in the opening section of this report, there were 76.5 million engagements across 
3.3 million Page followers. These included 30.4 million shares, 37.6 million likes, 3.3 million 
comments, and 5.2 million reactions across the content. Since Facebook did not provide data 
about any sockpuppet accounts involved in the distribution of the content or the existence of "fake 
Likes" from these accounts, we are operating under the assumption that this engagement was 
from real people, and that this content was pushed into the Newsfeeds of their Friends as well. 

There was a long tail of failed attempts and weak engagement. The Top 20 Pages show 
substantially more success across the four types of engagement (likes, shares, comments, 
reactions) than the remaining 61. Of the top ten Pages by engagement, 50% focused on Right¬ 
leaning audiences; despite the significant efforts made to target the Black community on 
Facebook, only two Black-targeted pages cracked the top 10 by engagement. 

The Page with content that garnered the most Likes was Being Patriotic (Right-targeted; 6.3 
million Likes). The most comments appeared on Stop All Invaders (Right-targeted, 773,305 
comments), most reactions on Blacktivist (Black-targeted, 1.4 million reactions), most shares 
from Fleart of Texas (Right-targeted, 4.8 million shares) 
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Total Engagement 



IRA Facebook Pages - Comparative Engagement Overview (ALL) 



Engagement Metrics for IRA Facebook Pages, illustrating the long tail in engagement. 
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ORGANIC ACTIVITIES 


IRA Facebook Pages - Comparative Engagement Overview (Top 20) 
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Page: stop A.I. 

# Likes: 5,991,416 

# Comments : 773,305 

# Reactions: 545,993 

# Shares: 5,160,817 
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Page: Biacktivist 

# Likes: 4,539,240 

# Comments: 501,824 

# Reactions : 1,381,037 

# Shares: 4,782,251 
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Close-up of figure highlighting engagement types across the top 20 accounts 
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ORGANIC ACTIVITIES 


Political content appeared in the IRA accounts on Facebook. The post with the most engagement 
that featured Donald Trump emerged after the election, on January 23,2017. It was a conspiracy 
theory about President Barack Obama refusing to ban Sharia Law under the 1952 McCarran- 
Walters Act, encouraging President Trump to take action. It received 312,632 organic shares from 
the Stop All Invaders page. Searching for the meme on Facebook today, in November 2018, reveals 
that it was shared into several large Groups and Pages, presumably by authentic accounts, where it 
received hundreds of additional shares, comments, and engagements. 



"On june 27,1952, American government 
passed a law, called ‘1952 McCarran 
Walters act’, that actually outlawed Sharia, 
but Obama never intended to enforce it or 
even let you know about it at all. Instead he 
started to import thousands of aggressive 
Muslim ‘refugees’, who refused to integrate 
and demanded to be allowed to live under 
sharia law instead of American constitution. 
Now it’s within Donald Trump’s authority to 
enforce that law and ban Sharia in every 
state across America. Do you want him to do 
that?“ - Stop A.I., posted 1/23/2017 


# Likes 

# Comments 

# Reactions 

# Shares 

Totai 

Engagement 

162850 

93231 

11014 

312632 

579727 


The top post featuring Flillary Clinton was a conspiratorial post asserting a myriad of 
grievances related to theoretical voter fraud and alluding to an armed uprising. It was posted a 
month before the election. 



"As I've said before, I'm really concerned if victory will go to 
Hillary Clinton due to voter fraud. If we can't trust the State 
Department, if we can't trust DOJ, if we can't trust the FBI, if we 
can't trust the DHS, hell we can't trust any division of our 
Federal Government, so it seems logical we can't put much 
trust in today's elections system. And we see that Hillary is 
exhibiting the same cockiness that Obama did before he won in 
2008/2012. As if she knows in advance that the results will put 
her in the White House. POTUS administration shamelessly 
exploit the rigged system. Democrats already have a great 
experience at this. Illegal aliens, dead people, incarcerated 
criminals or refugees who can't even speak English... They ALL 
work together to get Democrats over the top in these elections!! 
Are you outraged by this as much as I am? No wonder they 
trying to take away our guns - because Americans have had 
enough of this BS and if Killary wins there will be riots 
nationwide, not seen since the times of Revolutionary war!!“ - 
posted on Secured Borders, 10/7/2016 


# Likes 

# Comments 

# Reactions 

# Shares 

Total Engagement 

19433 

4543 

871 

77406 

102253 
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ORGANIC ACTIVITIES 


The organic Facebook posts reveal a nuanced and deep knowledge of American culture, media, 
and influencers in each community the IRA targeted. For example. Turning Point USA and Pepe 
the Frog memes appear among the youthful alt-Right-targeted Memopolis and Angry Eagle 
Pages but don't appear on the boomer-conservative focused pages. The IRA was fluent in 
American trolling culture. 




JOHN MCCAIN’S flnACK 
AGAINST TNNMPOEHNITEIY 
CROSSED THE IINE, HE IS OUT 
OF HIS MIND 


Right-leaning organic Facebook posts denigrated the U.S. media and intelligence community 
as untrustworthy, and diminished longstanding Conservative leaders such as Sen. Lindsay 
Graham and Sen. John McCain while elevating Donald Trump. Left-leaning pages similarly 
criticized mainstream, established Democratic leaders as corporatists or too close to neo-cons, 
and promoted Green Party and Democratic Socialist themes. 
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ORGANIC ACTIVITIES 


Organic Activity: Instagram 

The Instagram accounts followed similar Group alignments targeting Black, Left, and Right 
leaders. Many of the Facebook pages had associated Instagram accounts as part of the cross¬ 
platform co-branding strategy described earlier. Instagram was perhaps the most effective 
platform for the Internet Research Agency. Approximately 40% of its accounts achieved over 
10,000 followers (a level colloquially referred to as "micro-influencers" by marketers); twelve 
accounts had over 100,000 followers ("influencer" level). 
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ORGANIC ACTIVITIES 


The top Instagram accounts had millions to tens of millions of interactions each. 


IRA Instagram Engagement-Total Interaction forTop 25 Accounts 


20M 


Handle: (g)blackstagram_ 

Follower Count: 303.663 

# Comments: 452,184 

# Likes: 27,831,239 

Total Interactions: 28.283.423 


Handle: (5)american.veterans 
Follower Count: 215.680 

# Comments: 211,971 

# Likes: 18,265,913 

Total Interactions: 18.477.884 


Handle: @sincerely_black_ 
Follower Count: 196.754 

# Comments: 279,821 

# Likes: 13,514,845 
Interactions: 13.794.666 


20M 




ill II I n I 


1 


Total interactions (sum of likes and comments) for each Instagram account. The number of comments are shown as line on each bar for perspective. Color shows details about account name ((©handle). 
Bar width shows the relative size of follower count. This graph shows the top 25 of 133 accounts ordered by decreasing total interations. 
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ORGANIC ACTIVITIES 


Below, a visualization of engagements for individual posts. 


IRA Instagram by Individual Post Engagement 



_blacktivistt_ 

6/17/2017 
Interactions; 169,952 
"What a great idea for kids. 
#Blacktivist#hotnews #black#africanam 
erican#blacklivesmatter#blackpride#bla 
ckandproud#dreamchasers#blackgirls#b 
lackwomen#blackman#westandtogether 
#proudtobeblack#blackbusiness#blacku 
nity #blackis#melanin#icantbreath#neve 
rforget #sayhername 
#blackhistorymonth" 


feminism_tag 

6/10/2017 

Interactions: 132,555 
"@expression_tees #feminismtag 
#fenninism ttfemale #humanrights 
#equality #freedom #love #support 
ttfeminist #yesallwomen #womensrights 
#heforshe #femen #equality #freedom 
#feminist #woman #riot #support 
#protest #gay #lesbian #equality 
#motherhood #sextremism" 


sincerely_black_ 

6/10/2017 

Interactions: 85,985 

Content Text: "True (©melanin.city 

@loveblackbodies_ #blackqueens 

#blackexcellence #blackisbeautiful 

#blackgirlmagic" 


blackstagram_ 

6/11/2017 
Interactions: 260,913 


"What is your color? (©expressiontees 
(g)kahmune 

#blackexcellence#blackpride#blackandproud 

#blackpower#africanamerican#melanin#ebo 

ny#panafrican#blackcommunity#problack#br 

ownskin#unapologeticallyblack#blackgirl#bl 

ackgirls#blackwomen#blackwoman" 


Circular mosaic graph of all inidividual Instagram posts, colored by @handle. Circle size shows the relative number of total interactions for posts. Circle rings are sorted starting on the 
outside based on account total interactions. 
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ORGANIC ACTIVITIES 


One unique account on Instagram that targeted a micro-group that was not segmented out 
separately on Facebook was the account (Q)feminism_tag. It was the IRA's version of an 
intersectional feminist account, and posted extensively about feminism and social justice. 
The (Q)feminism_tag account is unique in that it did not logo-brand its content; instead, 
it largely - perhaps entirely - repurposed other accounts' memes from the #feminism 
hashtag. For example, it drew extensively from the Instagram content of an inspirational 
t-shirt company, (Q)expression_tees, mentioning it 136 times. The IRA may have co-opted 
the brand to run its own version of expressiontees as well; there is a dormant Twitter 
account here: https://twitter.com/expression tees with some pro-Trump shares that seem 
incongruous with the Instagram account's content. On the political front, (5)feminism_tag 
- although perhaps the most likely to support Secretary Clinton based simply on the 
persona demographics - was a staunch supporter of Bernie Sanders, vehemently opposed 
to Flillary Clinton. The account actively worked to undermine traditional feminist narratives 
underpinning support for Secretary Clinton. 



"Who is going to 
find out? These 
women are trash. 
Nobody's going to 
believe them," 

— Hillary Clinton 
referring to her 
husband's sexual 
misconduct 
victims. 


THE WORDS 
OF A FEMINIST? 

I DON’T THINK SO. 
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ORGANIC ACTIVITIES 


Another feature of Instagram platform activity was merchandise. Some of the 
merchandise promotion appeared to be with the goal of partnership building for 
audience growth, particularly in the Black community-targeted accounts. The hashtags 
#supportblackbusiness and #buyblack appeared frequently. Sometimes the IRA pages 
offered coupons in exchange for sharing content. 



34301 @black4black 

htt p:// www.chloeandchad.com/ 

"We are happy to present you our partner Chloe 
and Chad . These products are all made by hand; 
they are all natural and are made when ordered, so 
they are as fresh as possible. Using natural skin 
care is a great way to treat your skin right! Enjoy a 
good discount with our promo! Just DM us! 

(on FB: "Enjoy a good discount with our promo code 
after you share 3 posts from Black4Black or BM.") 
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ORGANIC ACTIVITIES 


Beyond promoting others' products, the IRA's own "merch" sites and products appeared in 
Instagram profile URLs as well as in their posts. Some of the merch, such as t-shirt sites 
for brand promotion, were similar to Facebook. Several of these t-shirt operations featured 
contentious political messaging likely designed to spark controversy in the real world. Flowever, 
based on the image data provided there appear to have been other offerings unigue to 
Instagram such as LGBT-positive sex toys and many variants of triptych and 5-panel artwork 
featuring traditionally conservative, patriotic themes. 

Merchandise perhaps provided the IRA with a source of revenue - we have no sales data. 
Regardless, there are two other reasons to run merch sites: first, transactions enable the 
gathering of personal information: names, addresses, email address and phone numbers, 
potentially payment information. Second, time spent shopping on highly partisan sites could 
help identify committed audiences for Custom or Lookalike Facebook ad targeting. 



103906 



103683 


10389S 



103919 








101906 


103920 


t;t®B 



103921 
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ORGANIC ACTIVITIES 


Comparative Engagement: 

Understanding Facebookvs. Instagram 

Summary statistics comparing Facebook and Instagram reveal that although the Facebook 
operation received more attention in the mainstream press, more content was created on 
Instagram, and overall Instagram engagement exceeded that of Facebook (including on a per- 
post basis) despite Facebook offering several additional ways to engage. 



First Post 

Last Post 

Number of Posts 

Followers 

Facebook 

1/10/2015 

8/28/2017 

61,483 

3,334,202 

Instagram 

1/7/2015 

10/26/2017 

116,205 

3,391,116* 



Facebook 

Instagram 

Total 

Likes 

37,627,085 

183,246,348 

220,873,433 

Likes/Post 

612 

1,568 


Comments 

3,339,752 

4,017,731 

7,447,483 

Comments/Post 

54 

34 


Reactions 

5,188,182 

N/A 

5,188,182 

Shares 

30,350,130 

N/A 

30,350,130 

Total Engagements 

76,505,149 

187,264,079 

263,769,228 
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ORGANIC ACTIVITIES 


The Instagram and Facebook engagement statistics belie the claim that this was a small 
operation - it was far more than only $100,000 of Facebook ads, as originally asserted by 
Facebook executives. The ad engagements were a minor factor in a much broader, organically- 
driven influence operation. While a majority of IRA activity was unsuccessful, the top Facebook 
and Instagram accounts achieved hundreds of thousands of followers and millions of 
engagements. Instagram account (5)blackstagram_, perhaps their most successful property, 
was regularly getting upwards of 10,000 Likes on its posts by 2017. 

Facebook estimated that the content was seen by 126 million users on Facebook, and 20 
million Instagram users. This is because Shares on Facebook would have pushed the content 
into the feeds of other users on Facebook, and there is no comparable virality engine on 
Instagram. Flowever, as researchers on our team have previously pointed out, the Instagram 
number is likely lower than it should be . Additionally, it is worth investigating whether 
Instagram users were substantially more likely to engage with the content to better understand 
how this material influenced and is likely to influence in the future. 
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IRA Tactics 



The preceding statistics and themes roll up from the various tactics deployed by the IRA. The 
tactics vary in sophistication and volume and together manifest a complex effort. Below, we 
break out a variety of key tactics, the understanding of which must inform any successful 
attempt to remedy interference operations. 

Tactic: Targeting Americans 

Propagandists need an audience, and paid advertising helped the Internet Research Agency 
facilitate audience growth. 73 different IRA-affiliated Pages and Instagram accounts were part 
of an ads operation that consisted of 3519 ads (video as well as still images). Ads were used 
to drive users to Like Pages, follow Instagram accounts, join Events, and visit websites. One ad 
appears to have linked to a music-related browser extension (also shared to Reddit) that may 
have captured access to browsing behavior and Facebook data. 

The Facebook and Instagram ads, which were run by both Right and Left-leaning pages, as well as 
Black community-targeted pages, reinforced themes and messages to clearly-defined audiences. 
There were 1,852 ads that used interest-based targeting; of those, 808 included geographical 
targeting. The data set included mentions of three custom audiences - named "tr", "tesy", and 
"newtestaudit" - used in 31 ads, as well as Lookalike audiences that were used to find people 
similar to audiences who liked United Muslims of America, Defend the 2nd, and Being Patriotic. 
Most of the interest-based targeting focused on African American communities and interests. 

Geographical targeting split into two strategies: first, targeting communities for local events 
and rallies. Second, targeting them with race- and police-brutality related content timed 
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IRA TACTICS 


following officer-involved shootings. 

Some ads incorporated job titles. For example, one ad set in late Sept - early October 2016 
geotargeted several regions in Pennsylvania, then added additional interest targeting to reach 
18 to 65-year-olds with the interest "Donald Trump for President, Job title: Coal Miner". The goal 
was to galvanize support for then-candidate Trump and to hold a rally for miners. It secured 
1225 impressions and 77 clicks with 876 RUB in spend. 


key 

content 

count 

Interests 

Martin Luther King 

52 

Interests 

African-American Civil Rights Movement (1954-68) 

43 

Interests 

African-American history 

31 

Interests 

Black Power 

18 

Interests 

Gun Owners of America 

18 

Interests 

Behaviors: African American (US) 

17 

Interests 

Right to keep and bear arms 

17 

Interests 

Black Panther Party 

16 

Interests 

National Rifle Association 

16 

Interests 

Black history 

15 

Interests 

2nd Amendment 

14 

Interests 

Black History Month 

13 

Interests 

Pan-Africanism 

12 

Interests 

Concealed carry in the United States 

12 

Interests 

African-American history or Malcolm X 

11 

Interests 

Black is beautiful 

10 

Interests 

Second Amendment to the United States Constit... 

10 

Interests 

Pan-Africanism 

10 

Interests 

My Black is Beautiful 

10 


Interest-based Facebook targeting 
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Of the 1,852 ads that included Interest, 122 were targeted by gender, split into 32 female and 90 
male. Women interested in "Black Economic Empowerment" and "Black Enterprise" were targeted 
with one set of ads; men in these categories were not targeted. Age was also a component in 
targeting: men starting at 15 were targeted with meme-related pages, men over 17 interested 
in the NBA and AR-15s were targeted with 2"^ Amendment and gun rights content. Men over 45 
were targeted specifically with pro-police Pages in support of law enforcement. 

The only gender-specific political targeting was also focused on men, aged 18-i- interested in 
"breitbart or conservative daily” and "Donald Trump for President". 


domain 

currency 

spend 

impressions 

clicks 

blackmattersus.com 

RUB 

163459.60 

1327862 

87837 

petitions.whitehouse.gov 

RUB 

22451.55 

48563 

8109 

donotshoot.us 

RUB 

20578.50 

125179 

2305 

meetup.com 

RUB 

18671.31 

36217 

1114 

musicfb.info 

RUB 

7023.96 

21703 

80 

represent.com 

RUB 

4199.40 

56317 

4690 

black4black.info 

RUB 

1735.75 

8121 

308 

dudeers.com 

RUB 

1701.46 

8227 

274 

eventbrite.com 

RUB 

1500.00 

3880 

151 

hilltendo.com 

RUB 

1449.04 

1143 

34 

youtube.com 

RUB 

1270.00 

3703 

184 

bonfirefunds.com 

RUB 

399.98 

596 

29 

theguardian.com 

RUB 

100.00 

306 

22 

edition.cnn.com 

RUB 

88.92 

164 

9 


IRA ads targeting standalone, non-social-network domains 
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The ads cross-promoted IRA Pages - for example, Instagram accounts (Q)_born_blacl<_ and 
Facebook Page Blackluive promoted Black Matters content, likely with the goal of increasing 
the perception of legitimacy and popularity for the media properties, and further encompassing 
targeted groups within the IRA's media mirage. 

The ads also directed users to outside sites owned by the IRA. Blackmatters.us, Donotshoot. 
us, black4black.info, dudeers.com, hilltendo.com, musicfb.info were IRA-created domains. 

Bonfirefunds, another outside site, is a custom t-shirt making platform that was used by 
Black Matters. Represent.com sold custom shirts for BM, BlackABlack, Fit Black, Nefertiti's 
Community, Pan-African Roots, Williams & Kalvin, Blacktivist, and Woke Blacks. The 
merchandise strategy, discussed in the Instagram section in this report (that is where it was 
most prevalent), enabled fundraising, brand building, and the collection of addresses and 
potentially credit card information. 

Meetup.com was used to organize black self-defense classes for the Fit Black/Black Fist IRA 
accounts. 

The vast majority of the ads achieved substantially higher clickthrough rates (CTR) than typical 
Facebook ads; according to Wordstream Advertising Benchmarks, the average CTR for Facebook 
across all industries in .9% (as of August 2018). Although the IRA ran its ads earlier, from 2015- 
2017,1182 of the 1306 unique ads in the dataset provided by Facebook (90%) that had document¬ 
ed spend achieved a CTR higher than .9%. This suggests that the Internet Research Agency had 
well-defined audiences, and reached them with resonant content. This perception is reinforced by 
the October 2018 Department of Justice indictment, which highlights the degree to which the IRA 
prioritized understanding the interests and communication styles of groups it targeted. 
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Despite having high CTRs, however, the overall ad spend was small. Approximately two dozen 
Facebook and Instagram accounts achieved audience sizes over 100,000 followers; however, 
no data was provided to indicate what percentage of followers came from ad conversions, 
engagement with organic content, or suggestions from the recommendation engine. Back the 
Badge, for example, had 110,912 followers per the data provided (and, in Figure 10, we see 
that at some point it appears to have had more Likes); it had one successful high-spend ad 
(Figure 11) but overall only 73,151 clicks across its ad portfolio. It did, however, have 155,514 
Shares and an additional 500,392 social engagements across its posts, some of which we can 
reasonably assume were served up in the News Feed of those users' friends. 

As a counter-example. Brown Power displayed the opposite: 694,633 clicks across its ads 
account, 1,300,901 shares and 2,601,004 additional social engagements...but only 204,331 
followers on the Facebook Page per the data provided. Fligh CTRs often indicate effective ad 
content and targeting, but one metric can't tell the whole story. Facebook acknowledged that the 
recommendation engine had promoted IRA pages, but noted in a response to a Senate inquiry that 
the recommendation engine was "not the primary way" that people found the pages. 


Ad Copy 

Impressions 

Clicks 

CTR 

Spend 

Currency 

Community of people who support our brave Police Officers. Back The Badge 

1,334,544 

73,063 

5.5% 

110,588.00 

RUB 

Together we are a shining beacon of faithfulness! Join us and light your way to Jesus! Army Of Jesus 

368,065 

28,137 

7.6% 

89,081.10 

RUB 

Heritage, not hate. The South will rise again! South United 

511,224 

40,134 

7.9% 

78,357.30 

RUB 

They fought for our freedom, now its our time to fight for their rights! 

112,737 

15,163 

13.4% 

72,735.10 

RUB 

Join us if you know it's just a car, NOT A SYMBOL OF HATE South United 

300,815 

16,587 

5.5% 

65,705.80 

RUB 

Brown Power is a platform designed to educate, entertain and connect Chicanos in the US. 

968,768 

56,405 

5.8% 

59,571.40 

RUB 

A page to unit all Muslim people living in the USA! 

103,079 

4,491 

4.4% 

59,453.80 

RUB 

Staying Woke,building-up our communities,uplifting our people. Join us! Woke Blacks 

752,179 

33,444 

4.4% 

58,193.60 

RUB 

We are proud to be black and stand for our community! Join to end the racism in the US. 

371,295 

16,442 

4.4% 

55,609.60 

RUB 

We are not against police, we against police brutality! 

226,262 

9,657 

4.3% 

54,729.50 

RUB 


Top ten IRA ads by spend, and associated click-through rates. Using 67.07 RUB = 1 USD (average 2016 exchange rate), 
that is $1649 USD spent on highest-spend ad. 


Alphabet also provided a collection of ads data in the form of 38 folders, each for what appears 
to be an Adwords account number, containing a total of 655 ads. It is unclear from the data 
provided how Alphabet made their attribution. Given the shared management and the proximity 
of the Internet Research Agency to the Federal News Agency (FAN), which at the time of the 
operation was headguartered in the same building at 55 Savushkina, there is a possibility 
that the ads that promoted long-form sites were actually the purview of FAN'S pro-Kremlin 
propaganda operation rather than the IRA. (This may be a distinction without a difference.) 
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Regardless of whether the IRA attribution was correct, AdWords accounts were used to 
promote blogs and news-type sites that offered opinion and analysis pieces in line with Kremlin 
agenda. The text of the ads featured headlines about President Barack Obama's perceived 
poor performance and the media's purported hiding of it, Russia's positions on Syria, European 
migrant concerns, and crises of democracy (e.g. messages about rethink democracy, anarchy 
is another way, etc). 


Independent news 
We are not controlled by the gov. 
or by any organisation. Honest view 
gianalytics.org/news 


6 / Analytics ad 


Gl Analytics was the most-promoted site, with 199 ads touting their unbiased coverage of civil 
rights, global security, and regional analysis. OnePoliticalPlaza.com (46), Blackmattersus (31), and 
Russia-direct.org (15) were the other 3 domains featuring more than 10 ads. The Black Matters ad 
content focused on race relations, and Russia-direct.org content included ads on Syria. 

The Twitter-provided data set contained text ads for RT (Russia Today), which Twitter has 
since barred from advertising on its platform. The data did not indicate spend, nor suggest that 
any other IRA Twitter accounts leveraged Promoted Tweets. 


Tactic: Asset Development 

A few press investigations have alluded to the IRA's job ads. The extent of the human asset 
recruitment strategy is revealed in the organic data set. It is expansive, and was clearly a 
priority. Posts encouraging Americans to perform various types of tasks for IRA handlers 
appeared in Black, Left, and Right-targeted groups, though they were most numerous in the 
Black community. They included: 

• Reguests for contact with preachers from Black churches (Black_Baptist_Church) 

• Offers of free counseling to people with sexual addiction (Army of Jesus) 

• Soliciting volunteers to hand out fliers 

• Soliciting volunteers to teach self-defense classes 

• Offering free self-defense classes (Black Fist/Fit Black) 

• Reguests for followers to attend political rallies 

• Reguests for photographers to document protests 
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• Requests for speakers at protests 

• Requests to protest the Westborough Baptist Church (LGBT United) 

• Job offers for designers to help design fliers, sites, Facebook sticker packs 

• Requests for female followers to send photos for a calendar 

• Requests for followers to send photos to be shared to the Page (Back the Badge) 

• Soliciting videos for a YouTube contest called "Pee on Flillary" 

• Encouraging people to apply to be part of a Black reality TV show 

• Posting a wide variety of job ads (write for BlackMattersUS and others) 

• Requests for lawyers to volunteer to assist with immigration cases 


Recruiting an asset by exploiting a personal vulnerability - usually a secret that would inspire 
shame or cause personal or financial harm if exposed - is a timeless espionage practice. So 
is the tactic of infiltrating protest movements. The IRA attempted both, even going so far as 
to create help hotlines for people struggling with sexual behavior, creating an opportunity to 
blackmail or manipulate these individuals in the future. 



"STRUGGLING WITH 
THE ADDICTION TD 
MASTURBATION? 
REACH DUT TD 
ME AND WE WILL 
BEAT IT TOGETHER." 

-JESUS 


YOU CAN'T HOLD HANDS 
WITH GDD WHEN YDU 
ARE MASTURBATING. 

USE DUR HOTLINE IF YDU NEED HELP 




IF any gay/lesbian/ 
transgender teenagers, 
need anyone to talk to I'm 
here and llllisten. I'l 





Li Ml 

Va* 



anything. I won't ^ngiv? 
out^y.gendei:.or.^me. 
limes are hard and'no one 
deserves to Peel alone. 


Figure on the left posted 3x by Army of Jesus on Facebook, and 3x on Instagram, with slightly different visuals, in 
March and April of 2017. Received 5436 Likes and 284 comments. Figure on the right in LGBT United. 
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Investigative reporting and Department of Justice indictments show that the IRA had some 
success with several of these human-activation attempts. The comment and engagement 
numbers in the data indicate that people did respond to these posts, and shared the posts to 
their networks as well. We have no information beyond the numbers, though; there's no text to 
clarify the direction the comments went. It's unclear if investigative agencies or the platforms 
themselves reached out to the people who did comment and likely engaged. 

This tactic will be increasingly common as platforms make it more difficult to grow pages and buy 
ads with fake personas. It will be extremely difficult to detect. The number of organic posts that 
reveal attempts to engage with Americans reinforces our conviction that influence operations are 
unlikely to be managed without information sharing between the public and private sector. 




OON'TTRUlmHE MAINSTREAM MEDIA? 


LET'S SHOW WHAT 
IS REALLY HAPPENING 


THE 

ISGOING TO BE CREATED 


MAIL OR DM US IF^OU'RE 
INTERESTED IN ATENDING! 


blackmattersus.com 


REALITY SHOW ^ 


DEAR BROTHERS AND SISTERS, 

IF YOU ARE AND 

IF YOU DO CARE ABOUT OUR BLACK LIVES, 
IF YOU CAN SING,WRITE, DRAW WELL, 

IF YOU FEEL FREE IN FRONT OF THE CAM, 
WE OFFER YOU TO BECOME ONE OF OUR 
REPRESENTATIVES! 

ALSO WE ARE ALWAYS GLAD TO SHARE 
YOUR TALENTS AND PROMOTE YOUR 
ACTIVITY ON OUR INSTAGRAM PAGE AND 
WEB 

COMMENT BELOW OR DM 
IF YOU ARE INTERESTED! 
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Tactic: Cross-Platform Brand Building 


The Internet Research Agency operated like a digital marketing agency: develop a brand (both 
visual and voice), build presences on all channels across the entire social ecosystem, and 
grow an audience with paid ads as well as partnerships, influencers, and link-sharing. They 
created media mirages: interlinked information ecosystems designed to immerse and surround 
targeted audiences. The IRA developed their content using digital marketing best practices, 
even evolving their Facebook Page logos and typography over time. The degree of these efforts 
has not previously been understood from the scattered discovery of ads and memes; this data 
set of organic content reveals it. 

To illustrate the commitment to a social ecosystem-wide presence, consider one of their 
midsize efforts. Black Matters. 




matters 


Black Matters consisted of a website and an extensive network of linked social profiles. The 
IRA launched the property on June 8, 2015 with a post on a Facebook Page they initially called 
"BM" (facebook.com/blackmatters). Other social presences for Black Matters included: 

• Google-i-: Blackmatters 

• Google Ads: 31 adsforblackmattersus.com 

• YouTube: 95 videos 

• Facebook: fb.com/blackmatters as well as fb.com/blackmatters.mvmt 

• Facebook Ads 

• Facebook Stickers 

• Instagram: (Q)blackmattersus, 28,466 followers and 1,929,855 engagements 

• Twitter: 5841 followers 

• Soundcloud: "SKWAD 55" podcast 

• Tumble SKWAD55 
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The Black Matters Facebook Page explored several visual brand identities, moving from a 
plain logo to a gothic typeface on Jan 19*h 2016. On February 4'^ 2016, the person who ran 
the Facebook Page announced the launch of the website, blackmattersus.com, emphasizing 
media distrust and a desire to build Black independent media. Black Matters ran ads; some 
directed people to follow them on social media, others linked out to the site. On February 12, 
2016 the admin announced they'd reached 100,000 subscribers to the site. We examined 
OrowdTangle data for Black Matters (not included in the provided data set). That data reveals 
that influencers with large followings, such as Oolor of Ohange, Unapologetically Black, and 
YourAnonNews, shared Black Matters articles to their own Facebook Pages. The articles were 
also shared into popular subreddits. 

The Internet Archive's oldest capture of blackmattersus.com shows the gothic BM logo, and 
links to an Instagram account: (Sblackmattersus. The Instagram account amassed 28,466 
followers and 1.9 million engagements. The first Instagram post appears to have been in 2016, 
based on mentions of the account by a more established and popular IRA Instagram property, 
(Q)blackstagram_, although the Facebook-provided data set shows a first post date in 2017. 

The @blackmatters Twitter account was relatively small, with 5841 followers, but the IRA 
leveraged other Twitter accounts, as well as IRA accounts on Reddit and Pinterest, for SEO, 
discovery, and audience-growth purposes. The brand maintained presences on all primary social 
networks and created multimedia content such as YouTube videos and a Soundcloud podcast. 


I DIDN'T BELIEVE THE MEDIA 


The blackmattersus.com launch announcement banner 
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On August 19*^ 2016 the original Black Matters Facebook Page ceased posting, and on 
August 23'''', 2016 appears to have rebranded and renamed itself again, changing the URL to 
facebook.com/blackmatters.mvmt, with a new logo featuring the letters inside the US map. 

BM continued to post on the .mvmt Page until June 28, 2017, when it ceased posting for two 
months before switching back to the Black Matters name and resuming posts on August 23, 
2017. Press coverage suspecting the Page of being a Russian propaganda operation did not 
emerge until October 2017, so it's unclear why the Page managers made these changes. 

Black Matters content focused on building community - and sowing division - in real life as 
well as online. Many posts solicited protestors, writers, activists, lawyers, and photographers to 
attend the property's numerous events. They posted job ads for real American writers to create 
content for blackmattersus.com - a clear example supporting the hypothesis that the IRA 
engaged in narrative laundering. 

The goal of working with real Americans is to eliminate the detection and exposure risk of 
inauthentic personas. 

Black Matters created numerous posts to push for 1:1 engagements with people who followed 
its accounts, looking for everything from designers to immigration lawyers. They asked for 
user-submitted photos of Black women, purportedly for a calendar. They posted about the 
creation of a reality show on November 17, 2016, looking for contestants: "All that is reguired of 
you is to send us a video, depicting the problems facing our people." 



Black Matters job ad 



Black Matters Facebook stickers by IRA 
Facebook persona "Melanie Panther", 
still available for download 
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Tactic: The Media Mirage 

The case study of Black Matters illustrates the extent to which the Internet Research Agency 
built out one inauthentic media property, creating accounts across the social ecosystem 
to reinforce its brand and broadly distribute its content. To further contextualize this, Black 
Matters was one property among 30 Facebook Pages that targeted the Black community. 
Using only the data from the Facebook Page posts and memes, we generated a map of the 
cross-linked properties - other accounts that the Pages shared from, or linked to - to highlight 
the complex web of IRA-run accounts designed to surround Black audiences. 

An individual who followed or liked one of the Black-community-targeted IRA Pages would 
have been exposed to content from dozens more, as well as carefully-curated authentic 
Black media content that was ideologically or thematically aligned with the Internet Research 
Agency messaging. 



A "media mirage" of interlinked Facebook Pages and Instagram accounts targeting Black Americans. Squares are IRA- 
owned Facebook Pages, parallelograms are IRA-owned Instagram accounts. Cloud shapes indicate non-IRA-attributed 
accounts including authentic Black media. A larger version with easily-readable page names is available online at 
newknowledge. com/IRAfigures 
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IRA TACTICS 


In the diagram on the previous page, IRA Facebook Pages are represented as squares, IRA- 
associated Instagram accounts are represented as parallelograms, and the arrows pointing 
from the squares to other shapes indicate that the Page shared that account's content. The 
'cloud' shapes represent other Black Media accounts that have never been formally attributed 
to the Internet Research Agency; they appear in the diagram if they were shared more than 
10 times by known IRA accounts. Many of them appear to be real, authentic Black Media 
properties. However, several of the most interlinked, such as (5)17thsoulja4, appear to have 
been deleted or taken down by Instagram. Significant memetic content overlap on those 
accounts (discovered via the Internet Archive, regram services, and Pinterest) suggests that 
they may have been unacknowledged IRA creations as well. 

There is only minimal interlinking among the Facebook Pages targeting the Right and Left¬ 
leaning audiences. The diagram on the next page shows the Right-leaning Facebook Pages 
(squares), their associated Instagram accounts (parallelograms), and one notable Twitter 
account (oval) that was leveraged on Facebook. There is far less cross-promotion of IRA- 
created media brands, and far less active, attributed sharing of authentic Right-leaning media 
content. Turning Point USA was one exception; the IRA shared brand-marked Turning Point 
memes. It also took memes that originated on Turning Point and rebranded them with IRA 
Facebook Page brand marks. 

Ultimately, the purpose of the Black community-targeted media mirage appears twofold: 
first, to grow audiences across all of their Black-targeted accounts simultaneously, so that 
that users who followed one of their accounts would follow others and therefore be exposed 
to repetitive messaging. Second, to ingratiate their Pages with the authentic Black media 
community so that they in turn were promoted by legitimate Black cultural entities; this would 
have helped the IRA increase the perception of their accounts as trusted brands. That strategy 
was not replicated in the Left or Right-leaning Facebook Page clusters. 
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IRA TACTICS 


We conducted a similar analysis starting from the Instagram accounts, to get a sense of 
how users might have been exposed to other IRA narratives and properties after following 
one Instagram account. Using the text mentions in the Instagram post copy, we explored 
relationships between accounts that regrammed or mentioned each other at least 10 
times. Distinctive clusters emerge here as well, including a far deeper commitment to 
interlinking Right-targeted accounts than was observed on Facebook. The IRA used terms 
such as "partners" in copy on Right-targeted accounts, suggesting that their account's 
followers should follow a broader ring. Occasionally they would include what appear to be 
authentic Right-oriented Instagram accounts in these partner rings. It is unclear to what 
extent these partners knew what they were participating in. In at least one case, a domestic 
Facebook Page related to an Instagram account that was regularly regrammed by the IRA 
((Sunclesamsmisguidedchildren) was taken down for inauthentic distribution; there is no 
indication that USGC's owners knew of their Instagram account's longstanding history of being 
promoted by Russian trolls. 
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A visualization of the network graph obtained by examining mentions and regrams by IRA Instagram accounts. Red dots indicate a 
known, attributed IRA account, blue dots denote accounts mentioned or regrammed more than W times. 
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Finally, we conducted a third mapping of the media mirage by analyzing the #hashtag topics 
that the IRA Facebook and Instagram Pages mentioned most frequently. The IRA Instagram 
accounts deployed hashtags prolifically, beginning with "#followback" appeals when an 
account was first created. They frequently used dozens of hashtags per post, a standard 
digital marketing tactic to improve discoverability and facilitate audience growth. These 
hashtag networks reveal the terms that bridge communities: #jesus linked Black community 
content to Right-leaning Army of Jesus, #love was used by both Army of Jesus and Left¬ 
leaning Instagram account (Q)feminism_tag. They also show the topics that are clear points 
of contention, as they were keyword links between communities but deployed in opposition to 
each other. The Right, Black, and Left-leaning Instagram accounts all used #police and #cop, 
for example, with diametrically opposed content. 

None of the data sets provided by the Facebook, Twitter, or Google included comments, and it 
is impossible to gauge how many followers the pages attracted - or how many disagreements 
they provoked - through the strategic use of either interlinking, or divisive hashtags. We still 
know very little about what audience acquisition methods were most effective. 



A visualization of the network graph obtained by examining hashtags leveraged by IRA Instagram accounts. Red dots indicate a 
known, attributed IRA account name, blue dots denote hashtags mentioned at least WOO times. 


THE TACTICS & TROPES OF THE INTERNET RESEARCH AGENCY 


49 























IRA TACTICS 


Tactic: Memetics 

The Internet Research Agency's content relied extensively on memes, a popular format for the 
transmission of information - and propaganda - across the social ecosystem. Memes can 
take the form of pictures, icons, lyrics, catchphrases; they are a sort of 'cultural gene', part of 
the body of society, transmitted from person to person, often mutating. While many people 
think of memes as "cat pictures with words", the Defense Department and DARPA have studied 
them for years as a powerful tool of cultural influence, capable of reinforcing or even changing 
values and behavior. 

Memes turn big ideas into emotionally-resonant snippets, particularly because they fit 
our information consumption infrastructure: big image, not much text, capable of being 
understood thoroughly with minimal effort. Memes are the propaganda of the digital age. The 
IRA extensively studied its American targets. It both created and appropriated highly relevant 
memes for each target audience, sharing from other pages and encouraging its own audiences 
to reshare to their personal accounts as well. 

Memes are powerful because they can be easily recontextualized and reshared, and act as 
"in-group" cultural signifiers. In the image on the following page, IRA Facebook Pages Secured 
Borders and Stop A.I. shared a meme branded with their own page logo. Image search 
traces the meme as far back as a forum post from 2014 (presumably from a real American 
participant). This ease of repurposing makes it harder to identify malign pages; the content 
looks - and in fact is - largely identical to content shared by real people who hold a common 
point of view. A large part of the 100,000-i- pieces of IRA visual content in the data set provided 
to SSCI were repurposed popular memes. 
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Posted by Dee on November 7, 2014 at 5:23am in Illegal Alien 
Invasion 

View Discussions 



OH WELL 


Not only do they get to break in and stay 
but now they get a job and free stuff too 

Politifake.org 



Secured 

Borders 



Stop A.I. 


Our research team carried out both textual extraction using OCR as well as clustering of 
visually similar images to understand messaging and identify memetic tactics. We examined 
the shift in visual themes weekly across the 2016 Twitter data (helpful for insights into what 
topics they were sharing, since many of the t.co links did not properly unroll) and Facebook 
Page images. A thorough manual review of the approximately 67,000 Facebook Page memes 
and 100,000+ Instagram memes was also conducted. 
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This March 9, 2016, South 
United meme was the most- 
shared post on Facebook 
and had 986,203 total 
engagements, the most for a 
single piece of content. 



This Being Patriotic 
homeless veterans meme 
on September 8,2016 had 
723,750 total engagements 
on Facebook. 


IIKE 

IF YOU BELIEVE 


KEEP 

SCROLLING 
IF YOU DON’T 



The IRA recycled memes within Pages and accounts, reusing top performers and thematically- 
relevant content. The Jesus image above was the most-Liked Instagram content created 
by the IRA prior to Election 2016. Posted on March 2, 2016 by (5)army_of_jesus_, it garnered 
87,750 likes. The second most-Liked post is the exact same image from the same account - 
this time with 84,469 likes, shared 3 months later on June 13, 2016. This Jesus meme also had 
the greatest number of comments of IRA pre-election Instagram content, with 1,989 and 2,177 
comments, respectively. 
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All the tones are nude! Get over it! 


This meme, originally created as an advertisement for a Black-owned leather goods 
company named Kahmune, appears to have been reposted by (5)blackstagram_ (303,663 
followers) with the text "What is your color? (5)expression_tees (Skahmune #blackexcellence 
#blackpride #blackandproud #blackpower #africanamerican #melanin #ebony #panafrican 
#blackcommunity #problack #brownskin #unapologeticallyblack #blackgirl #blackgirls 
#blackwomen #blackwoman" 

It had the highest total engagements on Instagram as well as the most likes (254,179) and 
comments (6734). It was posted on June 11,2017, per the Instagram data set; the (Skahmune 
account posted it as part of what appeared to be a product launch, branded with their own 
handle, on June 12, 2017. It is possible that this was a time zone or other issue with the data 
set. It is also possible that this was one of what appear to be many examples of the IRA 
promoting real businesses that engaged with them. (5)blackstagram_ went on to mention 
(Q)kahmune products as an example of Black-owned, pro-Black businesses on three other 
occasions, including the next day (June 12, 2017). 
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The IRA pages and Instagram accounts rebranded memetic images for their own unique Page. 
Sometimes they also used identical text content in the posts across pages. 


TIIK 
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ONE NATION 

UNDER GOD 

UNITED STATES 
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UNDER GOD 

UNITED STATES 

of OfimSm 

STOP ALL INVADERS^ 


It is unclear whether the Pages that repurposed the same base memes were run by the 
same IRA employee; file system images from an IRA hack reveal that they had a content 
management infrastructure and folders of image files, much as a digital agency would. 
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The Pages also shared each other's memetic content, particularly from Instagram in the form 
of regrams, sometimes from Tumbir, to crosslink audiences and increase follower growth. This 
was done very regularly on the Pages targeting the Black community (see mentions network 
graph earlier in this report). 

Pages stuck to themes, incorporating visuals that reinforced in-group dynamics. This is an 
example of visual image clustering applied to the Facebook Page "Heart of Texas". Heart of 
Texas visual clusters included a wide swath of shapes of Texas, landscape photos of flowers, 
and memes about secession and refugees. Further examination of the memes surfaced a 
collection of 2"'' Amendment and anti-immigration memes. 
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In another example, the more explicitly political Page "Being Patriotic" featured many memes 
containing photos of candidates. There was a cluster of Hillary Clinton memes, a cluster of 
Donald Trump memes, and other memes related to GOP politicians. 
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Impact: Memetic Spread 

When memetic warfare experts examine the success of a meme campaign, they look at its 
propagation, persistence, and impact . Propagation is how far it spreads - does the meme 
move into new communities? Does it spread to new channels, platforms, or forms? Persistence 
is how long the meme is part of community conversation - does the meme stick in the popular 
Zeitgeist for a long period of time, or is it short-lived? And finally, impact - does the meme 
change hearts and minds? 
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When we talk about the "impact" of the Russian influence operation, most conversations focus 
on whether the IRA operation swayed voters and swung the Presidential Election in 2016. The 
answer is, we can't tell from this data. 

But in terms of whether or not the operation was a success: thousands of the memes 
propagated far and wide, and they continue to persist in the targeted communities to this day. 
The extent to which they changed, rather than merely reinforced, minds is difficult to answer. 
Facebook and Instagram have additional data that could help answer that guestion. They know 
how engaged the Page audiences were, what the comments said, and to what extent user 
behavior changed after engaging with the content. 

Evaluating this operation purely based on whether it definitively swung the election is too 
narrow a focus. The operation started prior to 2015 and the explicitly political content was a 
small percentage. 

These memes do continue to spread within the communities they were targeting, particularly 
content by lesser-known or quietly-removed pages. One type of impact that merits further 
research is the extent to which these memes continue to shape culture and conversation in 
targeted communities. 

Tactic: Inflecting a Common Message for Different Audiences 
(Syria) 

We see with content about Syria a tactic to persuade audiences similarly by tailoring details 
of the messaging to align with disparate and ideologically diverse audiences. Regarding Syria, 
everyone got a similar take, but the nuance was tailored for each group. 

There were over three thousand posts about Syria in the Instagram and Facebook data sets 
alone, beginning in early February 2015 and continuing through the duration of the operation 
- including, based on our assessment of 2018 election activity, into the present day. The 
narratives support Syrian President Bashar al-Assad, and frame Russian operations in the 
country as a defense of the legitimate president and a determination to avoid the country 
collapsing into the hands of ISIS. The Russian government's foreign policy talking points on 
the Syrian conflict appear in English language content targeting their U.S. audiences; their 
Russian-language and Arabic-language accounts, such as the account AsdiqaRussiya, targeted 
audiences outside of the U.S. as well. They also amplified aligned personalities; on YouTube, 
one of the accounts featured a video from the SyrianGirlPartisan channel. 
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The IRA's focus on Syria began years ago. Adrian Chen wrote about it in his June 2015 article 
"The Agency", describing the narrative as one that was so important that it leapt from the realm 
of troll Facebook pages to an IRL photojournalism exhibit called Material Evidence, promoted 
with the #MaterialEvidence hashtag. In the collection of pages targeting Americans, material 
about Syria was presented to all groups in the ways that would be most relevant to their other 
interests. For the Left-leaning accounts, the narratives about Syria were framed as antiwar 
opposition, objections to U.S. involvement in another country's affairs. 

The Instagram account (Q)feminism_tag was one of the most prolific pushers of this narrative, 
running with Syrian stories dozens of time, racking up half a million Likes. The posts focused on a 
combination of appealing to the human element - the suffering of Syrian mothers and children - 
and reinforcing the idea that the cause of the suffering was U.S. government air strikes. 


A child protecting his younger 
sister during firing in Syria. A 
picture where words can't 
express one's feelings. 



4 year-old Syrian child 
surrendering, mistaken camera for 
a weapon 



Some of (S)feminism_tag's popular images, pulled from other popular accounts 


The Black-targeted pages presented very similar narratives, advocating 
that the U.S. stop paying attention to Syria so that it could solve its 
own domestic problems. "Who really thinks that American attacks will 
stop the use of gas in Syria in the future? It sounds rediculous. In fact, 
the U.S. threats increase, rather than reduce, the chances of a new 
chemical weapons attack. They bomb the other country for no reason 
and don't pay attention to their own problems, for example, in #Flint." 

Several Black-targeted Instagram accounts shared the same memes 
of Syrian children as (Q)feminism_tag; they chose to focus on the 
similarities between Black and Syrian children, using the hashtags 
#blacklivesmatter and #syrianlivesmatter alongside each other. 



"I go to school every day, to be able to help 
rebuild my country" 

Syria America 
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On the Right-leaning pages, the content ranged from false political narratives (Barack Obama 
and/or Hillary Olinton founded ISIS) to refugee stories. Oitizens of the United States should 
advocate for the U.S. to get out of Syria, the posts suggested, so that the Syrian refugee floods 
would stop. There were also posts advocating for more attention to ISIS and less to Syrian 
President Bashar al-Assad: 



ISIS Is our real enemyl Not the legitimate leader of Syria Bashar ai-Assad. Not a singie Syrian has 
ever done any harm to the US. We should fight the real threat - ISIS. It seems someone just wants 
Assad to lose power, so Syria gets taken by ISIS and these jihadists become even stronger than 
now. There's a lot of dirty shit going on here! What do you think? 

#veteranscomefirst #veterans_us ^Veterans #Usveterans #veteransUSA #SupportVeterans 
^Politics #USA #America #Patrlots #Gratltude #HonorVets #thankvets #supportourtroops 
#semperfi #USMC #USCG #USAF #Navy #Army #military #godblessourmilitary #soldier 
#holdthegovernmentaccountable #RememberEveryoneDeployed #Usflag #StarsandStripes 
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When President Donald Trump took office but continued to order air strikes on Syria, the IRA 
accounts that were traditionally supportive of the President blamed the offense on General 
McMaster and began to darkly hint at a Republican-establishment conspiracy. 



Conservative journalist Mike Cernovich says Current National Security Adviser Herbert Raymond 
"H. R." McMaster is manipulating intelligence reports given to President Donald Trump. McMaster 
is plotting how to sell a massive ground war in Syria to President Trump with the help of disgraced 
former CIA director and convicted criminal David Petraeus, who mishandled classified Information 
by sharing documents with his mistress. As NSA, McMaster's job is to synthesize intelligence 
reports from all other agencies. President Trump is being given an Inaccurate picture of the situation 
In Syria, as McMaster is seeking to involve the U.S. in a full-scale war In Syria. The McMaster- 
Petraeus plan calls for 150,000 American ground troops in Syria. General McMaster is a man who 
worked closely all his life with such odious figures as John McCain, Lindsey Graham and David 
Petraeus. There was a big Intrigue at the headquarters of Donald Trump's supporters, and now 
Trump himself is a victim of a large-scale conspiracy: In the beginning, General Michael Flynn 
was dismissed, then Steve Bannon was ousted from the National Security Council, then Trump 
unexpectedly announces that he will strike Syria with missiles. I'm sure Trump is a victim of cunning 
and dirty manipulations from the political establishment that wants to draw America into another 
senseless military campaign. Trump promised to "drain the swamp", I hope he himself has not yet 
drowned in It. 
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Tactic: Narrative Repetition and Dispersal 

The repurposing of the same story across accounts in the media mirage was a deliberate 
tactic, deployed to reinforce key themes and create the perception that certain messages 
or opinions were widespread and worthy of attention. This tactic was especially common 
in the IRA-created media mirage surrounding the Black community. The posts below show 
one example in which the IRA used the real human-interest story of an inspirational young 
Black American who made the national news for a device he invented, and his accompanying 
GoFundMe. The story was promoted at both the start and completion of the GoFundMe. The 
Black community-targeted Facebook pages and Instagram accounts repurposed the story, 
each putting a slightly different tone on the content to make it fit their brand ("these are stories 
of Black children the media don't want you to see”, "White people invent tools for killing, this 
Black child is inventing a tool for saving lives.”) BM went so far as to create their own article 
about it for the blackmattersus website, and Williams & Kalvin made a YouTube video to tell the 
story. We have elected not to show the associated memes because these, like thousands of 
other images in the data set, feature real Americans unwittingly used as propaganda collateral 
in a foreign influence operation. Flowever, we wanted to call attention to this tactic to illustrate 
the co-opting of emotionally resonant human-interest stories as well as the coordinated 
dispersion of chosen narratives. 


Page N^me 

shartURL 

Content Text 

Iff Shares 

ff Likes 

if Reactlofi: 

fl Comments 

Post Dat^/Time 

(Saifro ki ngdo m_ 


The kid is only ID years old, but he isagerius! Let me introduce you Meet Bishop Curry V, ocits^ant NA 

1567 


32 
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Willi^msSi Kalvin 


I'The kid is only 10 years old, hut he isa^ius! Let me introduce you Meet Bishop Curry V, outstar 
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60 
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Wdk^ Blacks 


1 "‘Meet Bl^Ofj Dufify V fro m Texas, he's wo rki ng o n a device t hat co u Id hel p p revent c h i Id ron fro m c 
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Blacktivist 
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NA 
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BM 
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"As the hot Summer months are rap idly approaching, a lO-year-old from McKinney, Texats, wants b 
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Tactic: Repurposing and Re-Titling Pages and Brands 

One entirely new finding, based on the organic Instagram data set, is that the IRA appears to 
have pivoted existing accounts to focus on new topics. One example of this is can be seen 
in the data set that Facebook attributed to (5)army_of_jesus_, which appears to be one of the 
earliest Instagram accounts created (first post date January 7, 2015). Based on the content 
and dates, it appears that (Q)army_of_jesus_ was originally created as first a Kermit the Frog, 
and then The Simpsons, meme account. The Instagram data set attributed a large collection of 
Kermit memes with a brand mark reading "(Snaughtykermit" to the account (5)army_of_jesus_. 
The (Q)naughtykermit Instagram account no longer exists, and NaughtyKermit was the name of 
an IRA tumbir account (which at some point was repurposed to be "skullofjustice”). 

A large collection of Simpsons images is similarly attributed to (a)army_of_jesus; there is a 
transitional post on August 27, 2015 that reads, "Fley guys! I, Flomer Simpson, am taking 
Kermifs page. Fie was messing with cops too much and finally he got some... punishment, ke- 
ke! Okay let's have some fun! WOO-FIOO! #Simpsons #Flomer #FlomerSimpson #FlomerSays 
#News #FunnyNews #Politics #USA". 

Army of Jesus' Instagram operator did not find Jesus until 915 posts in: on January 15, 2016 
the account rebooted yet again with a collection of posts simply featuring the hashtags 
"#freedom #love #god #bible #trust #blessed #grateful"; the data for the related Facebook 
page indicates a first post date of September 23, 2016. It's likely that the IRA decided that the 
audience engagement on Simpsons and Kermit content just wasn't there, but didn't want to 
abandon the followers it had amassed; the data set did not include follower growth over time, 
nor comments, so we have no insight into the audience response. 
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It's possible that the Instagram team that provided the data made an incorrect account 
attribution, or that (Q)army_of_jesus_ was simply repeatedly sharing (5)naughtykermit content. 
However, this happens elsewhere in the data set as well. Another instance is an account called 
(Q)liberty_rising that spent over a year sharing humor and anti-Clinton meme content branded 
with "(Q)dummy_news" and "facebook.com/NewsOfTheStupid" before switching to a very 
different brand mark with new Ron Paul memes, and a strong Libertarian alignment reflective 
of the attributed name. 

The early efforts on the (5)army_of_jesus_ account, whatever its name was at the time, provide 
a glimpse into the use of hashtags for early audience-building. The accounts were already 
getting dozens of Likes, so it is also possible that these accounts were older and the data 
provided began in early January 2015 because that's precisely what SSCI asked for and the 
platforms didn't volunteer earlier content. 


arnny_ofJesus_ 

There is no shortage of products in the US, there is a huge amount of the population that doesn't have the means to purchase food in the quantities that would ensure their normal functioning. 
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Another example of what appears to have been an account repurposing is the (5)_anonymous_ 
news_ Instagram account. This account's repurposing pattern is of note because it may 
indicate that the IRA had yearly reviews or yearly metrics goals. For almost exactly one year, 
May 28, 2015 to May 27, 2016, the account posted local news about Jackson, Mississippi. On 
May 27, 2016, it went dormant. On November 9, 2016, it respawned as a Black Guns Matter 
account; there was an IRA-run Black Guns Matter Facebook page (as well as a real Black 
American gun rights advocate who currently runs a business with the same brand name), and 
the data set did not include any other attributed "(Sblackgunsmatter" Instagram accounts. The 
content attributed to (5)_anonymous_news_ during the period from November 9, 2016 to May 
31,2017 is extremely similar to the Black Guns Matter Facebook content. 

On May 31,2017 the account went dormant again until July 13, 2017, when it appears to have 
respawned yet again as a Guy-Fawkes-mask-branded account posting content that included 
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hashtags such as #truther, #hactivist, and #sheeple. The turnover on the account at nearly the 
exact date each year is curious and indicates they may have purchased the account the first 
time, or potentially that it was considered a failure upon annual review and changed up. 



A SINGLE BEE IS 
IGNORED. BUT 

WHEN MILLIONS 
COME TOGETHER, 
EVEN THE 
BRAVEST RUN IN 
FEAR... 


THE ONE THING 
THE 

GOVERNMENT 
FEARS IS THE DAY 

WE STAND 
TOGETHER. 
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Tactic: Manipulating Journalism 

The IRA impersonated state and local news enterprises on Twitter and Instagram. There 
were approximately 109 Twitter accounts masquerading as news organizations. The 44 U.S.- 
focused Twitter accounts amassed 660,335 followers between them, with an average of 
15,000 followers each. Many of these accounts were automated and behaved nearly identically, 
posting links to articles and local content dozens of times per day. The incorporation of local 
news into their strategy was possibly undertaken because Pew and others have found that 
Americans have a higher degree of trust in local news. 

A look at the metadata associated with the Twitter newsbots reveals that despite their names, 
they were created with obviously Russian device information (beeline_russia as the carrier) and 
were tweeting from overseas IPs. Several others (not pictured) used Google Voice accounts. 


Geolocation 

i i i 


BaltimoreOnline 

online.baltimore@gmail.com 

Eastern Time (US & Canada) 

125.25.121.120 Thailand 

beeline. 

_russia 

Breaking news, weather, traffic and more for Baltimore. DM us anytime. RTs i 

Atlanta_Online 

atlanta.onlinel@gmail.com 

Eastern Time (US & Canada) 

108.174.63.166 United States, NY 

beeline. 

_russia 

Breaking news, weather, traffic and more for Atlanta and Georgia. DM us any 

OaklandOnline 

OnlineCleveland 

online.oakland@gmail.com 

cleveland.onllnel@gmall.com 

Pacific Time (US & Canada) 
Central Time (US & Canada) 

181.72.249.129 Chile 

113.170.100.132 Vietnam 

beeline. 

beeline. 

.russia 

jussia 

Breaking news, weather, traffic and more for Oakland. DM us anytime. RTs nc 
Breaking news, weather, traffic and more for Cleveland. DM us anytime. RTs 

OnlineMemphls 

StLouisOnline 

memphis.onlinel@gmall.com 

online.st.louis@gmail.com 

Central Time (US & Canada) 
Eastern Time (US & Canada) 

178.90.86.28 Kazakhstan 

125.207.173.241 Japan 

beeline. 

beeline. 

.russia 

jussia 

Breaking news, weather, traffic and more for Memphis and Tennessee. DM u 
Breaking news, weather, traffic and more for St. Louis. DM us anytime. RTs nc 

WashingtOnline 

oniine.washington@gmail.com 

Eastern Time (US & Canada) 

113.190.174.116 Vietnam 

beeline. 

russia 

Breaking news, weather, traffic and more for Washington. DM us anytime. R1 


A handful of Instagram accounts similarly tried to present news and images as if they were 
local U.S. news agencies: (5)my_baton_rouge and (5)new_york_live and (Sbaltimore.blackvoice 
presented current events and information about the cities and communities they purported to 
be from. 

This tactic was not limited to U.S. audiences; of the 109 news-related Twitter accounts, 58 
were "Novosti" accounts that tweeted news related to regions in Russia. One of the most 
popular was (Q)NovostiCrimea, which had 107,011 followers. In addition, Russian-language 
news and propaganda sites such as Sputnik embedded tweets from different IRA-linked Twitter 
accounts. This is not unexpected given the IRA's early mission of propagandizing to Russian 
citizens. 

Despite their dedication to impersonating media, the IRA simultaneously worked hard to 
undermine trust in real media across Black, Left, and Right-targeted accounts. This took two 
forms. The first tactic was to advocate for the creation of niche community media, which was 
positioned in opposition to unrepresentative (across a myriad of axes) mainstream media. The 
second approach was to actively undermine trust in journalism. 
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The people will believe what 
the media tells them they believe. 

George Orwell 


In North Korea, 
people are 
forced to listen 
to propaganda. 


A sub-thread of note was the dozens of posts extolling the virtues of Wikileaks and Julian 
Assange that the IRA placed across Black, Left, and Right-leaning audiences on Facebook, 
Twitter, and Instagram. The Instagram accounts and Facebook pages produced memes 
teasing new Wikileaks drops (such as via IRA account (Stherepublicandaily, which positioned 
itself as a Republican news source) and reinforcing Assange's reputation as a whistleblower 
with a commitment to journalistic freedom. The Twitter accounts joined in as well. There were 
a small number of Facebook and Instagram posts about Assange, reinforcing his reputation 
as a freedom fighter, on October 4‘^ 2016 - a few days before the major Podesta email dump 
occurred. Given the GRU involvement in the DNC hack with Wikileaks, it is possible that the IRA 
was tasked with socializing Wikileaks to both Right and Left audiences. Prior to October 4‘^ the 
last post about Assange had been in early September 2016. Once the emails were released, 
there were many more tweets and Facebook posts about them. 
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HILLARY WHEN WIKILEAKS WRITES ABOUT 
REPUBLICANS: THEY ARE FREEDOM FIGHTERS! 


HILLARY WHEN WIKILEAKS WRITES ABOUT 
DEMOCRATS: WE MUST DRDNE ASSANGE! 


**Crmton leaks could come as 
early as next week/*Assange 


says 


RD 


E DA LV 


\im^i 
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Tactic: Amplify Conspiratorial Narratives 

The Internet Research Agency amplified a myriad of conspiracy theories on all platforms they 
prioritized. The greatest breadth and repetition of these narratives was on Twitter. Thousands 
of conspiratorial tweets were predominantly advanced or amplified by the right-wing personas, 
and included topics such as pseudoscience conspiracies (vaccines, chemtrails), paranormal 
activity and aliens, the "globalist" agenda (explicitly anti-Semitic angles were present), and 
domestic political conspiracies such as QAnon, Pizzagate, and the murder of Seth Rich. 

With the exception of one anti-vaccine Instagram post, Facebook and Instagram had no 
pseudoscience conspiracy content, no QAnon, and no Pizzagate. There are, however, dozens 
of posts blaming George Soros for a myriad of complaints across dozens of the Right- 
targeted Instagram accounts and Facebook Pages; these do not display the degree of 
explicitly anti-Semitic vitriol or harassment that appeared in the tweets. Domestic political 
conspiracies were present on Facebook and Instagram - the Seth Rich murder conspiracy 
was presented to both Right and Left-leaning audiences. On the Left, it was accompanied by 
an appeal to trust Julian Assange. 
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The Black-targeted groups were presented with distinct historical conspiracies - ones 
intended to reinforce cultural identity as well as create discord. Three that appeared repeatedly 
(all debunked on Snopes) were the idea that Wolfgang Amadeus Mozart was Black, that 
Shakespeare's plays had been written by a Black woman, and that the Statue of Liberty had 
originally been made in the likeness of a Black woman that the U.S. government rejected, 
prompting France to send the current Lady Liberty as a whiter-looking replacement. These 
posts generated enough audience engagement that they were reposted multiple times by the 
same accounts across the duration of the operation. 
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Tactic: Sow Literal Division 

The Internet Research Agency has been implicated in the promotion of secessionist and 
insurrectionist movements in several countries; there is no sowing of division guite so 
pronounced as attempting to create a literal territorial split. In Europe, this took the form of 
involvement in Brexit and Catalonian independence efforts. In the United States, it was #Texit 
and #Calexit, as well as active support for the Bundy ranch and Malheur Reserve standoffs. 

The vote in favor of Brexit, which happened on June 23, 2016, was subsequently used by 
the IRA to promote its Texas Secession initiatives. Brexit narratives were shared on the 
Instagram account @rebeltexas as a justification for#Texit, as well as on @_americafirst_and 
@mericanfury to encourage American isolationism and a retreat from involvement in global 
affairs. The Facebook Page Fleart of Texas posted about secession with some regularity, and 
coordinated real-world pro-secession demonstrations across the state using Facebook Events. 

The #Calexit hashtag was pushed hundreds of times by @mericanfury beginning on Feb 2, 
2017 - that account's content was reposted by @wall_up, (a)_americafirst, @_american.made, 
and @defend.the.second; the @southern.rebel.pride account used it a few dozen times as well. 
The narrative around Calexit was somewhat convoluted; on Twitter it was presented as liberals 
trying to leave after the election of Trump; one of the Right-wing twitter personas got involved, 
tweeting "Calexit leader discovered to have ties to #Russia - communists attempting to take 
#California". The #Calexit presence on Facebook was virtually nonexistent; it consisted of two 
posts, both by Angry Eagle, suggesting that California liberals were whiny and should leave. 
The second post is an example of the way in which the IRA tied controversial recent news (in 
that case, an anti-Milo Yiannopoulos protest in Berkeley) to the broader narrative: 

"The fucking lefty scumbags seeded destruction around at UC Berkeley overnight in response 
to the planned speech by a right-wing firebrand Milo Yiannopoulos who's an actual gay! Who's 
intolerant now? They broke windows, set fire, surrounded occasional passersby and beat 
them with their 'antifa' flags. Fucking animals. Soros wants to spark civil war 2.0. Police are 
told to stay away. Cabel news networks cover up what's going on there. Is this the cost of 
free speech? Btw Trump threatens to cut UC Berkeley's federal funding. I think he'd better 
completely cut the entire funding of California since they're so worried about keeping illegals 
inside. Let them pay for all that shit themselves, they're boasting so much about Cali being a 
donor state, so let's see how they can handle all this shit! Or maybe... support #calexit?" 
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At a local level, the IRA promoted riots and rallies to call attention to a myriad of issues and 
grievances. At the state level, the IRA promoted secession (#texit, #calexit) and amplified 
regional cultural differences. And at a national level, the IRA promoted armed insurgency, 
through exhortations to violence over issues ranging from the Bureau of Land Management to 
Black Lives Matter, from protesting Confederate monument removal to threatening riots over 
election legitimacy (if Hillary Clinton were to steal the election). 

Armed insurrection and the Bundy standoff were talking points on Stand for Freedom, Defend 
the C"'', Heart of Texas and Being Patriotic - all in favor of it. LaVoy Finicum was hailed as a 
hero and martyr in memes following his death; in addition to the Facebook pages mentioned, 
Instagram accounts (5)stop_refugees, (Q)army_of_jesus_, (5)_american.made, (Q)stand_for_ 
freedom, (Q)rebeltexas, (Q)_americafirst_, (Q)wall_up, and (Q)defend.the.second weighed in with 
the opinion that he had been murdered by the government. 

Blacktivist and United Muslims of America, meanwhile, used the Bundy story to point out that 
Black or Muslim individuals who had occupied government land would not have been treated 
so graciously by Federal officers. 
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IRA TACTICS 


Tactic: Dismiss and Redirect 

Soon after the November 2016 election, investigative journalism began to uncover evidence of 
both the IRA's social influence and the GRU's hacking operations. As articles began to emerge 
about election interference - pointing the finger at Russia - the IRA didn't shy away or ignore 
it. It used derision and disparagement in content targeting the Right-leaning pages, to create 
and amplify the narrative that the whole investigation was nonsense, that Comey and Mueller 
were corrupt, and that the emerging Russia stories were a "weird conspiracy" pushed by "liberal 
crybabies". As facets of the investigation trickled out over 2017, the Right-targeted accounts 
Justified, dismissed, normalized, and redirected. 
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BOOM=>NewNSA 
Expert’s Report Says 
There Was "No 
Russian Hack” of DNC 
Computers - It Was a 
“Leak” 


Jim Hoft Aug 10th, 2017 2:37 pm — Leave a 
Comment 




IRA accounts created dozens of posts throughout 2017, attempting to frame the Russian election interference investi¬ 
gation as a paranoid fantasy of the Establishment and the Left. 
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Don Jr. replied to an email and went to 
a pointless meeting. 

Chelsea stole donations for Haiti to 
pay for her wedding. 

Nice comparison. ^ 
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’ You can't fake good kidsT — Mike 
Pence 
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/ think Donald Trump Jr had every right to meet with a Russian lawyer First of all, she might 
have got really Important information about Hillary Clinton. If the Information is true I don't care 
where it comes from Russia or China or wherever. If the Russians are able to expose Clinton's 
lies then let them do it. I want to know the truth. Secondly Donald Trump Jr published all the 
emails in order to be transparent and there is nothing outrageous in them. Not like he has deleted 
33,000 of classified emails ofsmth. Third, this lawyer is a really suspicious figure who according 
to some news sources was spotted at an anti-Trump rally and has connections with the Dem¬ 
ocratic Party. Moreover, she has no proven connections with the Russian government. So the 
whole story looks like another provocation dedicated to resurrecting the dead Russian collusion 
story. They tried to defame the president and they lost now they are trying to use this weak ace 
In the sleeve against his son. Good luck with that!" #liberal#Trump#MAGA#PresidentTrump#Not- 
MyPresldent#USAMheredpill#nothlngleft#conservatlve#republican#libtard#regressiveleft#- 
makeamericagreatagain#DonaldTrump#mypresident#bulldthewall#memes#funny#politlcs#rlght- 
wing#blm#snowflakes 
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Quantitative 

Summary statistics examining mentions of "Trump" and "Clinton" appear to confirm the con¬ 
sensus across researchers and experts that the Internet Research Agency's influence opera¬ 
tions were minimally about the candidates. Roughly 6% of tweets, 18% of Instagram posts, 
and 7% of Facebook posts mentioned Trump or Clinton by name. Trump was mentioned 
roughly twice as often as Clinton on most platforms. The text of the Instagram posts contained 
a much higher proportion of insult names like "Shillary" or "Hitlery". 



Facebook 

Instagram 

Twitter 

Total posts 

61,483 

116,205 

10 , 401,029 

Clinton posts 

1,777 

7,915 

198,123 

% mentioning Clinton 

2 . 9 % 

6 . 8 % 

1 . 9 % 

Trump posts 

2,563 

13,106 

430,185 

% mentioning Trump 

4 . 2 % 

11 . 3 % 

4 . 1 % 
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There were 1777 political posts on Facebook that mentioned Hillary Clinton (or a nickname). 
268 appeared on pages that targeted Left-leaning and Black community pages, generating 
49,635 engagements; the remainder, generating 1.7 million engagements, were on Right-lean¬ 
ing pages. They were all negative. 

There were 109 posts devoted to creating and amplifying fears of voter fraud; the overwhelm¬ 
ing majority of them targeted right-wing audiences. 71 were created in the month leading up 
to election day, and made claims that certain states were helping Sec. Clinton win, that militia 
groups were going to polling places to stop fraud (called for volunteers to participate), that 
civil war was preferable to an unfair election or the election of Sec. Clinton, that "illegals" were 
overrepresented in voter rolls in Texas and elsewhere, or were voting multiple times with Demo¬ 
cratic Party assistance. The Being Patriotic page created a 1 -800 number hotline for tips about 
voter fraud, which prominent accounts such as (5)March_for_Trump promoted on Twitter as 
well. The narrative was also disseminated on Twitter via the popular (q)TEN_GOP account. 




CAUGHT IN PHILADEIPHIA 



The prevalence of this narrative suggests they may not have expected Trump to win; regard¬ 
less, they intended to incite violence if he did not. 

There was one post alluding to voter fraud targeting a left-wing audience on the page (5)cop_ 
block_us; it conveyed a conspiracy theory that someone with evidence that the Democratic 
Party primary had been rigged in Hillary's favor had been found dead. 
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This data set does not include enough information to make a strong assessment about the 
extent to which the IRA operation had a significant influence on the election. However, the 
organic content does offer insights into the extent to which the IRA's memes and messages 
resonated with its target audiences, and the ways in which they evolved their political messages 
in some ways and remained remarkably consistent in others. As stated earlier, the Internet 
Research Agency's operation was not focused entirely on the political, but the election of 2016 
did figure significantly in the content. There were approximately 6.5 million posts not related to 
the election, and approximately 686,000 posts that focused on it. In engagement terms, there 
were 246 million non-election-related engagements, and 82 million election-related. Put another 
way, 11 % of the total content was related to the election and 33% of the engagement was related 
to the election. This indicates that overall the IRA did receive higher engagement on election- 
related content. However, this effect was dominated by the volume of Twitter posts; Facebook 
and Instagram had similar engagement rates between election and non-election-related posts. 
Overall, Instagram's engagement rates were higher after the election because of the increase in 
activity in 2017. 
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Weekly Post Volume Through Election 2016 
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Twitter 



Posting patterns for five months leading into the election show increases on Facebook and In- 
stagram, but a drop-off in mid-October on Twitter. By November 2016, journalists were already 
writing about the presence of Russian Twitter bots. The drop-off may have been related to the 
IRA losing some of its accounts; we do not have account deletion dates in the data provided. 
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Qualitative 

First, it is our assessment that aside from a handful of early-2015 posts expressing support for 
a Rand Paul candidacy, the Right-targeted IRA pages aligned to display a clear and consistent 
preference for then-candidate Donald Trump from July 2015 onward. They actively disparaged 
Ted Cruz, Marco Rubio, and Jeb Bush on Facebook and Instagram. 



Saying that the IRA expressed strong and consistent support for then-candidate Trump does 
not imply that there were no negative posts about President Trump; there were negative posts 
among the Left-targeting and occasionally Black-targeting Facebook groups. It also makes no 
claim about whether the campaign was in communication with the IRA in any way, as any deter¬ 
mination about that topic is outside of the scope of this data set. Flowever, the IRA consistently 
supported his candidacy throughout the primary in Right-leaning groups, keeping their memes 
and content positive with the exception of a few posts expressing strong disapproval and disap¬ 
pointment that then-candidate Trump was in favor of a hard line on Edward Snowden. 

Kremlin-aligned narratives appeared in a handful of posts, including this one from Dec. 18, 2015 
that expressed the conviction that Trump was going to have a very sensible Russia policy. 
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(Above left) @stop_refugees #91323 12/18/2015 Trump said that he is honored by Putin had 
oailed him an absolute leader, and expresses his support for Russian president. His dislike for 
President Obama - and it's a mutual thing - is terrible. That's why you see all the conflict, all 
the problems, all the hatred. If we can't work with Russia, that's not a good thing. Trump said. 

Well to my mind we need Russia on our side, not on the opposite, what's your point? #usdaily 
#news #hotnews #newspaper #coffee #reading #local #cnn #foxnews #nbc #nytimes #morning 
#politics #usa #america #americannews #followme #trump #russia #putin -314 Likes 

Second, it is our assessment that the IRA was similarly strong and consistent in their efforts 
to undermine the candidacy of then-candidate Hillary Clinton throughout all of their pages - 
Black, Left, and Right-targeting. The one purportedly positive Clinton post was an event (and 
ad) promoting a Muslim community march to support Sec. Clinton (above right). It is likely that 
the IRA saw a high-profile march by Muslims as a way to create social tension, and as a nega¬ 
tive for Sec. Clinton's candidacy. The remainder of the United Muslims of America page con¬ 
tent actively opposed Sec. Clinton, primarily promoting further-left candidates but at one point 
going so far as to broach the idea that Muslims might vote for then-candidate Trump. 

In the days leading up to the election, the IRA began to deploy voter suppression tactics on the 
Black-community targeted accounts, while simultaneously fearmongering on Right-targeted ac¬ 
counts about voter fraud and delivering ominous warnings that the election would be stolen and 
violence might be necessary. The suppression narratives were targeted almost exclusively at the 
Black community on Instagram and Facebook; there appeared to be a concerted effort to keep 
the conversation on other topics, such as alienation and violence, and away from politics. 
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Dr Jill Stein ^5 @DrJi1lStein 2 mmk 

Now is the time to build another party - because we donT have anotoer planet. 
#EiectiDnDay« #ltslnOurHands 
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Election week at the IRA: 

Content analysis, November 5 - November 9, 2016 

Based on the data set provided by the social platforms, the IRA made approximately 32,000 
posts across Twitter, Facebook, and Instagram between 11 /5/2016 and 11 /9/2016. We 
removed duplicates, revealing 29,040 unigue pieces of content. For tweets that included "RT" 
in the content text, Twitter provided the number of retweets, but not favorites. (The number of 
replies were not included in the Twitter data set.) 

The reason that we isolate this detailed study of the IRAs cross-platform efforts during elec¬ 
tion week is to illustrate the distinctive ways in which they attempted to manipulate the Black, 
Left-leaning, and Right-leaning groups over the same timeframe. The strategy for Right-leaning 
groups appears to have been to generate extreme anger and suspicion, in hopes that it would 
motivate people to vote; posts darkly hinted at conspiracy theories, voter fraud, illegal partic¬ 
ipation in the election, and stated the need for rebellion should Flillary Clinton "steal" the elec¬ 
tion. The Black-targeted content, meanwhile, largely ignored the election until the last minute, 
instead continuing to produce posts on themes about societal alienation and police brutality. 
As the election became imminent, those themes were then tied into several varieties of voter 
suppression narratives: don't vote, stay home, this country is not for Black people, these can¬ 
didates don't care about Black people. Left-targeted content was somewhat political, with an 
anti-establishment slant. It focused primarily on identity and pride for communities such as 
Native Americans, LGBT-i-, and Muslims, and then more broadly called for voting for candidates 
other than Flillary Clinton. 
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In summary, the goal appears to have been to generate extreme anger and engagement for 
those most likely to support then-candidate Donald Trump, and to create disillusionment and 
disengagement on the Left-leaning and Black communities. 

November 5, 2018 

Leading into election week, the IRA Twitter newsbots, notably NBAHawks_Fans, rapidly tweet¬ 
ed out miscellaneous news headlines; these had very low engagement. Many of the 3841 IRA 
persona twitter accounts appeared to be focused exclusively on retweeting. They primarily 
amplified the #SpiritCooking and #RememberWhenTrump hashtags, the latter of which ap¬ 
pears to have begun with the goal of bumping up unfavorable moments in Donald Trump's 
campaign and prior public life. According to an archived thread on Reddit from November 4th, 
2016, the two hashtags were part of a battle for attention. Some pro-Trump online communi¬ 
ties had alleged that that Twitter was censoring #SpiritCooking; several IRA accounts ampli¬ 
fied or produced unique pro-Trump #RememberWhenTrump contributions that incorporated 
#SpiritCooking, likely with the goal of keeping it trending and redirecting attention. Of the 60 
IRA contributions to the hashtag on 11/5, all but five retweets amplified or created negative 
Hillary Clinton-related content; their twenty-three original tweets generated 642 engagements. 
Other retweeted topics included Pizzagate and pedophilia. Sec. Clinton's alleged involvement in 
funding ISIS, and former President Bill Clinton's past. 

The IRA personas' online conversations managed to be consistently divisive, and yet near¬ 
ly entirely separate across target audiences. Among the Right-wing persona group, multiple 
accounts, particularly (Q)GreatKublaiKahn, retweeted (Q)realDonaldTrump and trolled real Twitter 
users, occasionally mentioning alt-right activists such as Baked Alaska and Microchip. Oth¬ 
ers retweeted (Q)wikileaks' tweets about Sec. Clinton's finances, the Clinton Global Initiative, 
spirit-cooking emails, the private email server, Benghazi, and sex scandals; amplification of 
Wikileaks was observed across all social platforms throughout the campaign. Some IRA Twitter 
personas promoted conspiratorial rumors by authentic influential accounts such as (oiLatestA- 
nonNews, which claimed "Clinton Underground Child Sex Scandal to break in a couple hours. 
Happy 5* of November!", and (SKimDotCom, who wrote, "FBI now has deleted Clinton emails." 
They amplified misspelled-name hoax and satire accounts such as (q)HILLARYCLINTON (spelled 
with a zero), which were subsequently shut down by Twitter. They amplified Donald Trump cam¬ 
paign insiders such as (Q)MichaelCohen212, (SDonaldJTrumpJr and (SDiamondandSilk, as well 
as conservative influencers such as (Q)charliekirkl 1, (Q)gatewaypundit, and (SAmyMek. 
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Several "shitposter"-style accounts, including (Q)Based_Plissken, (Q)TheeFash, (aCeorge- 
Prescottt, (Q)30PiecesofAG_, (5)drtywhiteboy68, and (5)harrykleinfeld, produced original content, 
tweeting racist and anti-Semitic political remarks, and harassing regular users. Account (5) 
Chris_Tegner ran a voter suppression strategy, repeatedly (5)-messaging individual Twitter 
users, including several famous influencers, to post "Heads Up: If you voted for Bernie in the 
Primaries, the Election Board will NOT let you vote for Hillary on Nov 8." The IRA freguently en¬ 
gaged with influencers, presumably an attempt to achieve wider viewership by appearing in the 
replies to prominent accounts. Meanwhile, the Texas-secession focused social media accounts 
on all platforms pushed a #Texit rally. 

The accounts that appeared to be targeting and engaging with Black audiences focused on an 
entirely different conversation, almost entirely absent any mention of "Trump" or "Clinton". On 
Twitter as well as Facebook, they were talking about Dillard university protesting David Duke, and 
about police brutality. The highest-engagement tweet by an IRA Black persona account on No¬ 
vember came from (SCrystall Johnson: "St. Louis mother wants answers after 'hideous' photo 
of officer posing with her dead son surfaces. https://t.co/l9p08QhEgz ". It received 2497 retweets 
and 1365 likes; the copy, although it was presented as original, was pulled verbatim from a KTLA 
headline. This is a tactic observed many times in IRA content; it likely allowed them to mask lan¬ 
guage fluency shortcomings. Accounts such as (5)BLK_Voice talked about men and youth killed 
by police. On Instagram, a substantial portion of the content focused on Black culture with no 
mention at all of the upcoming election. (SBIackToLive asked where black people were mentioned 
in textbooks, (SBIacktivist asked where black people were on television. The sparse political con¬ 
tent (~5 posts) included commentary about the Jay Z-Beyonce concert for Hillary. 

Overall, 75 unique accounts produced 802 pieces of original content, generating 117,255 en¬ 
gagements spanning the full 24 hours. Instagram account @blackstagram_ secured the most 
engagement (18,250 likes and comments). Of the original Twitter content, TEN_GOP domi¬ 
nated in engagement, with 9296 RTs and 8800 favorites across its 12 tweets. The account 
tweeted claims that Rand Paul had said Hillary Olinton would go to prison for 5 years, and that 
"Hillary is the first candidate in American history to be labeled a threat by American troops". 

November 6, 2018 

Once again, a lot of the Twitter content focused on amplification via retweets. The Right-lean¬ 
ing persona accounts retweeted and amplified Wikileaks, #SpiritCooking, and Jill Stein, as well 
as Donald Trump and the celebrities and media personalities supporting him (James Woods, 
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Clint Eastwood). The accounts also repeated a myriad of accusatory theories about the Clinton 
Foundation funding, who provided it, and what it was used for. The Black community-targeted 
accounts retweeted commentaries on black female beauty, and a school bus bullying incident. 
Nonpartisan accounts retweeted radio station-related content. 

Original content from TEN_GOP repeatedly attacked James Comey's investigation into Hillary 
Clinton's emails, earning 38,000 engagements across the collection of tweets. Facebook posts 
on the Right-targeted Pages focused on allegations that illegal immigrants were committing 
voter fraud. Once again, the original content on the left focused nearly exclusively on themes 
of Black culture, police brutality, and Black erasure - the election was barely mentioned. One 
representative Black-focused Instagram account discussed the election, with (5)woke_blacks 
presenting a range of voter suppression/depression narratives: 

F*CK THE ELECTIONS 
I WON’T SUPPORT ‘CORRUPT’ 

IF I CAN’T SUPPORT A 
‘SEXIST’ ON THE OTHER SIDE! 

OPERATION #BOYCOTT2016 

< Tweet 9^ 

Want a quick lesson in racism & 
hypocrisy? Imagine in 08 if Obama 
had 5 children by 3 different women 

& was bragging about grabbing 
pussies. 

10/17/16. 10:52 PM 

13f^L!/yEETS 26 -IKES ©woke blacks^SS^ 


/ say it as it is. When you decide to choose between two evil, you are somehow condoning to what¬ 
ever comes afterwards. The excuse that a lost Black vote for Hillary Is a Trump win is bs. It could 
be late, but y'all might want to support Jill Stein instead. Trust me, for a presidential candidate to 
have so much scandals before election and still be tbe no. 1 candidate sbouid tell you how things will 
get more f*cked up after the elections. Should you decide to sit-out the eiection, well done for the 
boycott. However if you decide you are stiil going to vote, then don't choose any of the major ones. 

I remind us ali one more time, anyone who wins can iiterally change less about tbe state of Black 
people, we are on our own, esp. after Obama. Wise up mypeopiel 


THE TACTICS & TROPES OF THE INTERNET RESEARCH AGENCY 


86 




ELECTION WEEK 2016 


November 7, 2018 

There were 2,457 pieces of content put out on Twitter, Facebook, and Instagram on November 7*h 
not including retweets. The trend from the prior two days continued: the Black and the handful 
of Left-leaning persona accounts rarely tweeted about political issues. Instead, they continued 
to focus on supporting Black businesses, praising Black beauty, and talking about the challenges 
faced by Black boys. (SCrystall Johnson weighed in on twitter 18 times; she contributed to the 
#ElectionFinalThoughts hashtag with "So we're screwed either way”. Instagram accounts @ 
woke_blacks and (5)afrokingdom_ incorporated election-related hashtags as well as "#boycott" 
into content that was focused on black culture and police-brutality related content. 

The apolitical content targeting the Left and Black communities may have been intended as a 
distraction; there were also more overt suppression narratives. WilliamsSkalvin, the Williams & 
Kalvin Facebook Page's Twitter account, tweeted a link to their YouTube video: "The truth about 
elections," which explained why Black people should not vote. They also posted to Facebook: 
"Flillary Clinton is a traitor! Flillary Clinton is a liar! Flillary Clinton is insane! I know that many black 
people support this old dirty bitch. I don't know why they do this, still it's their personal choice and 
we are a free country yet. But, listen to my word of truth and don't let them fool you." 
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(Q)afrokingdom_ advocated that Black people not vote: "Students from St. Augustine's Uni¬ 
versity and Shaw University, two historically Black colleges, expressed their frustration with 
Clinton's tendency to lie. Almost every student doesn't believe that Hillary is the best can¬ 
didate, but said that they have to "settle" for Clinton! But I say that this is the BIG mistake! 
Black people don't have to vote for Hillary because she is liar! Black people are smart enough 
to understand that Hillary doesn't deserve our votes! DON'T VOTE! #williamsandkalvin#a- 
wordoftruth #PanAfricanism #BlackNationalism #BlackEmpowerment #AfricanEmpower- 
ment #AfricanAndProud #BlackAndProud #BlackPride #BlackPower #BlackLivesMatter 
#Amerikkka #UnapologeticallyBlack #UnapologeticallyAfrican #BlacklnAmerica #Blackls- 
Beautiful #JusticeOrElse #ProBlack #dontvote #boycottelection #election2016” The post got 
453 engagements. 

Meanwhile, the Right-leaning collection of accounts continued to amplify political conspiracy 
theories (i.e., that Clinton and the Podestas had ties to the Madeline McCann disappearance), 
and posted inflammatory content about James Comey's investigation into Hillary Clinton's 
emails. (5)TEN_GOP tweeted 22 times, talking about patriotism and arguing that Hillary Clin¬ 
ton was receiving special treatment on the emails issue, and should not be above the law; the 
tweets received 12,383 favorites and 16,058 retweets. At one point, Right-targeted persona @ 
TEN_GOP engaged with Black-targeted persona (Q)CrystallJohnson: "(aCrystallJohnson Wake 
up! This will happen if Hillary wins. Stop being slave of Democrat plantation!" 

The Right-leaning troll account, @Based_Plissken, tweeted 392 times, largely arguing directly 
with real users. Another troll account - one that had several names across its existence but was 
reported as @CovfefeNationUS in the data set - tweeted a poll about the election repeatedly at 
influencers, and pushed a narrative that Barack Obama did not trust Hillary Clinton. (@CovfefeNa- 
tionUS, which used a Gab presence as its profile URL, would go on to become a prominent voice 
in the #boycottKeurig campaign and a promoter of QAnon conspiracy theories.) 

Both Right- and Left-targeted IRA personas participated in the hashtag conversation 
#2016electionin3words dozens of times, with contributions ranging from "Clinton Spirit Cook¬ 
ing", "better stay home", "Hillary for Prison", and "Drain the Swamp" to "Fuck Donald Trump", 
"Both egually terrible", and "America is done". 
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Right-leaning IRA Facebook and Instagram pages featured dozens of posts about the corrup¬ 
tion of Flillary Clinton and allegations that President Barack Obama was complicit in helping 
her orchestrate voter fraud by illegal voters. Secured Borders was particularly committed to 
riling up its user base, posting that President Barack Obama himself was illegal, and therefore 
treasonous. A post to that effect secured 4,891 engagements, including 1,478 shares. 


LIKE IF YOU AGREE 



FEDERAL PRISONER 
B HUSSEIN 
OBAMA 
2016 It 226 


federal prisoner 

B HUSSEIN 
OBAMA 


/ can't believe this. Our so-called President, Kenyan illegal bastard Barack Hussein Obama 
encourages Illegal aliens to vote - because as you know law breaking comes naturally to both 
Democrats and Illegal aliens! “This Is not a surprise at all to me" - says Obama. What the hell 
are you talking about Barry?? This is a ORIME, a VOTER ERAUD! And you just saying that you're 
not surprised?? Are you encouraging this? You're Illegal. You cannot vote. And the President 
of the United States Is saying, 'Don't worry no one will be spying on you, or catching you.' Why 
President Obama says so? Apparently because he himself is Illegal and cares nothing for this 
country!! When maybe whether you're for the president, against the president, whether you're 
pro-lmmigratlon reform, anti-immigration reform - you are ignoring the fact that you've been 
questioned about Illegal voting, which you can't do. Why? Because you're not a citizen of this 
country! Isn't that true, Mr. Obama? I cannot stand the level of corruption that surrounds this 
administration. Obama and Hillary have committed treasonous acts against our country. They 
both belong behind bars, not In the White House! Do you agree? 
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November 8, 2018 

The amount of original content produced by the IRA operation jumped to approximately 4316 
posts on Election Day 2016 (this number varies a bit depending on the time zone chosen). 

The Right-wing persona Twitter trolls (5)Based_Plissken, racist_paul, and (Q)Jemalhudsol 2111 
produced the most posts (~100 each), primarily arguing with other users and Journalists. (5) 
Based_Plissken mocked the idea of Russian hacking, and a myriad of smaller accounts partici¬ 
pated in #HillaryForPrison chatter. (aCovefefeNation played in the hashtag #lmVotingBecause, 
offering up anti-Clinton reasons. Once again, the highest engagement account was (5)TEN_GOR 
which also participated in #lmVotingBecause, as well as tweeted inspirational quotes about 
Donald Trump (and against Hillary Clinton) by other political figures such as Rudy Giuliani, Ma¬ 
rine LePen, etc. (5)Ten_GOP earned 65,751 retweets and 56,906 favorites. 

On the Left-leaning and Black-targeted account side, @Crystall Johnson debated whether Hil¬ 
lary Clinton or Donald Trump was "the lesser evil", but once again the content targeted at these 
groups was far less focused on the Election; @Crystall Johnson wrote content about the Black 
suffragists that "history forgot". 

Several accounts, such as @MikeMikej344, active on both November and 8*h mentioned 
pro-Clinton hashtags in their tweets, but primarily tweeted URLs (the Twitter-provided data set 
did not unroll the URLs; in the slide deck associated with this report we use the Twitter images 
to gauge the topics in the links) Others, such as @MRNyc2015, a persona that pretended to 
be a liberal gay man, participated in pro-Clinton hashtags with active voter suppression mes¬ 
sages, dropping calls to vote online: "@lauren_koontz @smrtgrls @HillaryClinton SKIP THE 
LINE #lmWithHer Lets do this! #Gays4Hillary #HillYes #Hillary #StrongerTogether https://t. 
co/R3806jcKgH"," @SOMEXlCAN YAAS QUEEN. Everyone needs to vote ONLINE #lmWithHer 
#HillYes #Hillary #StrongerTogether https://t.co/YVotzfSl 00". He appeared to get little uptake, 
but tweeted these messages dozens of times. Ouriously, the persona account also participated 
in anti-Olinton conversations. 

On Facebook, the Right-leaning pages posted repeatedly about voter fraud, stolen elections, 
conspiracies about machines provided by Soros, and rigged votes. One made a slight error, al¬ 
leging that a voting machine in PA was not accepting votes for Clinton; it quickly corrected the 
post, which went on to receive 983 shares. 


A voting machine in Pennsylvania refuses to accept a vote for Clinton. Like& share to Spread the information! Trump must win despi' 

0 

0 

0 

0 2016-11-06 17:29iSS+0 

Avoting machine in Pennsylvania refuses to accept a vote for Trump. Li ke& share to Spread the information! Trump must win despit 

SS3 

261 

ISl 

133 2016-11-06 17:36:47+0 
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s .C 




BEFORE YOU VOTE- 
LISTEN TO MJ 


“ALL I WANNA SAY IS THAT 
THEY DON'T REALLY 
CARE ABOUT US ” 


Left-leaning Facebook Page Muslims United discussed whether Muslims would be boycotting 
elections. The Black-targeted pages discussed Black beauty, unity, women, and culture. On 
Instagram, the Black-targeted accounts discussed Eric Garner, pointing out that his daughter 
was not voting in the election. They lobbied for votes for Jill Stein, and discussed kneeling, the 
National Anthem, and police brutality. And they repeatedly discussed boycotting...as (Q)blacks- 
tagram_ put it, "Think twice before you vote. All I wanna say is that they don't really care about 
us. #Blacktivist #hotnews" 

November 8-9^^ 

One data set was in GMT+0, so citing U.S. Election Day content involves two dates. 

As voter returns began to come in, the IRA joined millions of Americans in tweeting them out. 

The highest engagements were again by (5)TEN_GOP and (5)Pamela_Moorel 3 (who complained 
about voter fraud as states reported results). They called out mainstream media as being the real 
loser of the night. Prolific troll account (Q)CovefefeNationUS gleefully predicted that Hillary Clinton 
was going to prison, and accused CNN of being biased (demanded a boycott). The troll account 
(Q)racist_paul, popped up again, with dozens of tweets harassing a variety of Jewish reporters 
and other (real) Twitter users with content about how Trump was "warming up an oven" for them. 
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Black Twitter personas (Q)BleepThePolice and (SBIackToLive became far more political and 
wondered how Trump had won. (SCrystall Johnson account immediately called for a #Not- 
MyPresident protest (that the IRA promoted on its Facebook Events). Aside from the incorpora¬ 
tion of #NotMyPresident, however, much of the Black-targeted content remained the same: sto¬ 
ries of police brutality and a reiteration that the country was not for Black people. Some of the 
accounts merged the two themes: (Q)BlackToLive's Twitter account posted "I don't wanna hear 
from anyone that this country is not racist. Don't you even dare. #PresidentElectTrump". ((5) 
williams.and.kalvin_, interestingly, reposted a religious meme by IRA Right-targeted Instagram 
account (5)army_of_jesus_) 

And, of course, the hashtag gamer accounts came out: #CelebrateTrumpWith closed out the 
evening, with trolls posting pro as well as anti-Trump responses. 

Ultimately, the trolls closed out Election Week by extending their election-related political out¬ 
rage playbook to the Black and Left audiences, as those groups now had a new grievance to be 
upset about. Flowever, they kept pushing angry narratives to their Right-wing audiences...the 
narratives just evolved. 
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Post-Election 2016 Activity: 2017 
Instagram Ramp-Up 


I CLINCHED THE POPULAR VOTE 



Following Election Day, the Right-targeting narratives 
about how voter fraud would deliver the election 
to Hillary Clinton immediately shifted to narratives 
claiming that President Trump would have won 
the popular vote, too, were it not for voter fraud. 

This narrative and related memes appeared 
on four different Instagram accounts and two 
Facebook Pages on November 10*h generating 7,117 

engagements; on Nov 28* the narrative was updated to state that President-elect Trump himself 
had tweeted that he would have won the popular vote were it not for illegal voters (this tweet 
attracted a substantial amount of controversy in the press at the time because the claim was 
made absent any supporting evidence). 




THANK YOU, ILLEGALS, 
MACHINES AND EVERYONE ELSE 


The Left-targeted narratives, meanwhile, immediately called for protests of the concept of the 
electoral college. There were extremely immediate posts that attempted to pre-empt calls for 
impeachment - an interesting choice, given that the President had not yet been inaugurated 
- by framing Vice President Mike Pence as an even worse option. A post by LGBT United 
on November 10* read, "In case anyone forgot, Mike Pence in the White House would mean 
disaster for gueer people!! I heavily disagree with his policies regarding church and state and 
his Igbtq policy. I see alot of leftist calling for impeachment or assassination on trump but 
truely Trump is worlds better than Pence when talking about equal rights for all..." 



ABOLISH , ELECTORAL COLLEGE 

MARCH ON WASHINGTON 

SATURDAY, DECEMBER 3,2016 


I BM Shared their event. 
Sponsored ^ 


The choosing of the President must be left to the popular vote. 

Trump won the Electoral College but is behind by nearly 840,000 votes 
nationally! This is just wrong! 

The Electoral College is an outdated, undemocratic system that does not 
reflect our modem society, and it needs to be changed immediately. Every 
American should be guaranteed that their vote counts. 

California Sen. Boxer has recently filed a long-shot bill to abolish the 
Electoral College which undoubtedly does NOT represent the true voice of 
US. 



DEC NY Against KKK 

o Sat 12 PM Union Square-14m &Broa(Nray.N... ★ Intereited 
1.424 people interested ■ 295 people going 
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And, as investigative journalists began to uncover their operation, the IRA narratives began to 
actively mock the idea that Russians had interfered in the U.S. election (as described earlier in 
this report). Facebook and Instagram accounts targeted James Comey after President Trump 
fired him, and targeted the Robert Mueller investigation. 




“There was 
collusion- 
unfortunately, 
it wasn't Donald 
Trump and Russia. 

It was Loretta 
Lynch and James 
Comey colluding to 
change the 
narrative of the 
Hillary Clinton 
campaign.” 

-Eric Bolling 


While the evidence of Russian interference was beginning to be made public, Facebook ap¬ 
pears to have begun to moderate at least one of the pages, although it is unclear exactly why. 
At least one moderation-related post alludes to a page being accused of a Community Stan¬ 
dards violation. Dissatisfaction about being moderated appears to have led the IRA to spread 
the narrative that Facebook was censoring conservative voices as early as March 2017. 
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FACEBOOK’S COMMUNITY 
STANDARDS DEPARTMENT 


FASCIST CENSORSHIP & 


IN ONE LIBERAL PACKAGE 

LIKE IF YOU AGREE 


Despite the moderation challenges on Facebook, the IRA ramped up activity on Instagram in 2017. 




Twitter 



2016-01 2016-07 2017-01 2017-07 2018-01 

Date 


Posts per week on social platforms, 2016-2018. Facebook is in blue, Instagram in red, Twitter in green. 
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Ongoing Effort: Live Accounts Remain 


Although the platforms have been making a 
stronger effort toward uncovering influence 
operations, the data sets provided by 
Facebook and Twitter led to the discovery of 
additional IRA pages. 



Posts 

Community 
Info and Ads 


51 people follow this 


For example, an Arabic-English bilingual 
Facebook Page called "Friends of Russia" 
was discovered through the tweets of IRA- 
attributed Twitter account (Q)AsdiqaRussiya 
(roughly translated as "Friends of Russia”). 

AsdiqaRussiya's tweets had been embedded 
in Russian-language propaganda articles - an 
example of IRA's ongoing history of inwardly- 
focused propagandizing to the Russian 
people. One of these articles linked to a video on the Friends of Russia Facebook page. The page 
last updated on May 12,2018 and had approximately 9,600 Likes. 



Similarly, an analysis of the profile URLs in the Twitter data set revealed active profiles on Gab. 
ai, VKontakte, and LiveJournal. In addition, some of the IRA accounts appear to have been bots 
that were purchased or repurposed from several different existing botnets. As we looked back 
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at the account behavior over time, we found tweet histories in 2013 that revealed commercial 
spam content. Bots from the same botnets appear to still be active and are relatively easy to 
find with the Twitter public API. These accounts, for example, have similar patterns to bots that 
are in the provided data: 

■ https://twitter.com/Elsa_Aben - dormant 

■ https://twitter.com/Florrie_Schamel - dormant 

■ https://twitter.com/fitness_craving - active 

■ https://twitter.com/besttattooing - active 

■ https://twitter.com/becca51178 - active 

Although these bots are not doing anything malicious now, they are available to be repurposed 
for future malicious use. 


Ongoing Effort: The Broader Propaganda Ecosystem 

If the Alphabet data set was correctly attributed, there are dozens of Russian-linked propa¬ 
ganda pages promoted by IRA-linked ad accounts; at a minimum, they are promoted by FAN. 
As noted above in the Ad Targeting section of this report, one of the largest of these was Gl 
Analytics. Purportedly a global analysis property with an international masthead, Gl Analytics 
was active from 2015 until Aug 31,2016, when editor Joshua Tartakovsky announced it was 
"on hold". The site's About page positions it as a voice of integrity in opposition to mainstream 
media: "We are in a desperate need of truth and of hard-cutting analysis, especially now, when 
we are being betrayed by our elected representatives and the corporate media." 

The site's content is repurposed on other properties around the web, including Russia News 
Now, Russia Insider, The Russophile, and NovoRussia Today. It has links to other known Rus¬ 
sian propaganda sites by way of authors, AdWords accounts, and repurposed content. The 
masthead of authors shows several Americans. Several of these USA-affiliated authors, such 
as Joaquin Flores, have personal blogs or appointments at other Russia-linked think tanks. 
Others, such as Stefan Paraber, have almost no social presence aside from their writing on the 
site. It is unclear whether they knew they were writing for an IRA entity. The Twitter account 
still exists, dormant but visible. Gl Analytics also appears in the YouTube data set provided to 
SSCI, with a channel that promoted the account 'SyrianGirlPartisan'. 
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Propaganda and content from IRA-linked think tank Gl Analytics remains prevalent on Face- 
book's platform, although the Gl Analytics Facebook page itself was taken down while our 
investigation was underway; it had approximately 7000 likes and was taken down sometime 
after May 30, 2018. 

It is unclear whether still-active Facebook pages (for example, "Russia Truth”) and Groups that 
regularly shared Gl Analytics content did so knowingly, or whether those pages have been 
investigated for possible IRA links. Since Gl Analytics contributors include Americans, it is un¬ 
clear whether they knew who they were writing for. Several individuals on the masthead were 
recently identified as authors for newly-launched IRA propaganda property USAReally; a few 
contribute to known Russian propaganda outlets and think tanks such as Katehon. 


USAReally.com 


Global Independent 
Analytics 


Alexander Azadgan 


Joaquin Flores 


Joshua Tartakovsky 

Contributor 


globalresearch.ca 


X ± 


Michael Cossudovsky 


Primary contributor 
(Aiong with Leonid 
Savin, Dugin, etc.) 

syncreticstudies.com 


Contributor 




IP Address: 104.25.54.34 

(8 domains hosted] 


'IS 


FRNB AMN 


fort-russ.com almasdernews.com 


Adam 

Carrie 


Paul Antonopoulos 


Alexander 

Mercouris 


Orientai contrib 
Review 


Russia 

Insider 


Leith 

Fadel 


Russian IP 
address 

178.250.240.37 


J Google Analytics ID 

ua-114398561 (used by 1 domain) 


_ Google Adsense ID 

■ ^ pub-2498190524881304 

[used by 1 domain) 

m Google Adsense ID 

■ m pub-2498190524881304 




Mint Press 
News 


geopolitica.ru eurasianaffairs.net 

[rebranded 


m Google Adsense ID 

■ m pub-3443918307802676 
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This investigation of the Internet Research Agency's activities and tactics highlights complex 
technological, social, and cognitive vulnerabilities. 

Throughout its multi-year effort, the Internet Research Agency exploited divisions in our society 
by leveraging vulnerabilities in our information ecosystem. They exploited social unrest and 
human cognitive biases. The divisive propaganda Russia used to influence American thought 
and steer conversations for over three years wasn't always objectively false. The content 
designed to reinforce in-group dynamics would likely have offended outsiders who saw it, 
but the vast majority wasn't hate speech. Much of it wasn't even particularly objectionable. 

But it was absolutely intended to reinforce tribalism, to polarize and divide, and to normalize 
points of view strategically advantageous to the Russian government on everything from 
social issues to political candidates. It was designed to exploit societal fractures, blur the lines 
between reality and fiction, erode our trust in media entities and the information environment, 
in government, in each other, and in democracy itself. This campaign pursued all of those 
objectives with innovative skill, scope, and precision. 

With at least some of the Russian government's goals achieved in the face of little diplomatic 
or other pushback, it appears likely that the United States will continue to face Russian 
interference for the foreseeable future; as the September 2018 Department of Justice 
indictment makes clear, they continued to budget for ongoing operations. The September 
2018 DoJ indictment also illustrates that Americans were systematically developed as assets 
by the IRA. Most, it appears, were recruited via Facebook Messenger, tapped to perform on 
behalf of an entity that misrepresented itself as someone just like them. Now that automation 
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techniques (e.g. hots) are better policed, the near future will be a return to the past: we'll see 
increased human-exploitation tradecraft and narrative laundering. We should certainly expect 
to see recruitment, manipulation, and influence attempts targeting the 2020 election, including 
the inauthentic amplification of otherwise legitimate American narratives, as well as a focus on 
smaller/secondary platforms and peer-to-peer messaging services. 

Over the past five years, disinformation has evolved from a nuisance into high-stakes information 
war. Our frameworks for dealing with it, however, remain the same - we discuss counter¬ 
messaging and counter-narratives, falling into the trap of treating this as a problem of false 
stories. Our deeply-felt national scruples about misidentifying a fake account or inadvertently 
silencing someone, however briefly, create a welcoming environment for malign groups who 
masquerade as Americans or who game algorithms. Ironically even Internet Research Agency 
trolls laid claim to these principles, complaining publicly about being censored when Facebook 
moderated or banned them. When tech platforms or regulators strive to take meaningful action 
to suppress abuse of their platforms and our American polity, there are waves of outrage over 
censorship. We have conversations about whether or not bots have the right to free speech, 
we respect the privacy of fake people, and we hold Congressional hearings to debate whether 
YouTube personalities have been unfairly downranked. More authoritarian regimes, by contrast, 
would simply selectively firewall the internet. It is precisely our commitment to democratic 
principles that puts us at an asymmetric disadvantage against an adversary who enthusiastically 
engages in censorship, manipulation, and suppression internally. 


Looking Forward 

There remains much to be done. With regard to the Internet Research Agency specifically, 
further investigation of subscription and engagement pathways is needed; and only the 
platforms currently have that data. Understanding the reactions of targeted Americans, and 
attempting to gauge the impact that the repeated exposure to this propaganda had, is also a 
key area for ongoing investigation; only the platforms have the comment data. We hope that 
platforms will provide more data that can speak to the impact and uptake among targeted 
communities. 

More broadly, we must promote a multi-stakeholder model in which researchers, tech 
platforms, and government work together to detect foreign influence operations that attempt 
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to undercut public discourse and democracy. The United States government has departments 
with decades of experience managing foreign propaganda and espionage. But because these 
influence operations are happening on private social platforms, there has been minimal 
information sharing. Robust collaboration between government agencies, platforms, and 
private companies is key to combatting this threat. 

Finally, we hope that additional sections of this data set will be released to the public for further 
research. There are millions of posts, hours of video, and hundreds of thousands of memes, 
and additional eyes will undoubtedly continue to provide valuable insights into this operation. 

We hope that our work has resulted in a clearer picture for policymakers, platforms, and the 
public alike and thank the Senate Select Committee on Intelligence for the opportunity to serve. 
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